Plugins · phastpress · data as of 2026-11-04
Is PhastPress safe? Known vulnerabilities and latest version
- Latest version
- 3.13
- Last updated
- 2026-10-24
- Active installs
- 10,000+
- Known issues on record
- 3
- Unpatched in latest
- 0
- Tested up to WP
- 7.1.4 · PHP 7.3+
PhastPress automatically optimizes your site for the best possible performance. — by Albert Peschar
What to do
- Update to the latest version (3.13). Anything older than 3.11 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
- If you cannot update right away, deactivate it until you can.
- Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
- If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.
With WP-CLI: wp plugin get phastpress --field=version shows what you run; wp plugin update phastpress updates it.
Check your version
Known vulnerabilities
3 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version.
high 7.3 CVE-2026-3712 · published 2026-10-15
Server-side request forgery (SSRF) in PhastPress (3.10 and older)
- Affected
- 3.10 and older
- Fixed in
- 3.11 *
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the attacker-controlled HTTP 'Host' header. This makes it possible for unauthenticated attackers to spoof the header to match any target URL, bypassing the whitelist and forcing the server to make HTTP requests to arbitrary internal or external destinations and return the response content.
critical 9.8 CVE-2025-14388 · published 2025-12-23
Path traversal / file read in PhastPress (3.7 and older)
- Affected
- 3.7 and older
- Fixed in
- 3.8 *
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The PhastPress plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read via null byte injection in all versions up to, and including, 3.7. This is due to a discrepancy between the extension validation in `getExtensionForURL()` which operates on URL-decoded paths, and `appendNormalized()` which strips everything after a null byte before constructing the filesystem path. This makes it possible for unauthenticated attackers to read arbitrary files from the webroot, including wp-config.php, by appending a double URL-encoded null byte (%2500) followed by an allowed extension (.txt) to the file path.
NVD CVE-2025-14388Wordfence advisoryCode change (fix)Plugin source
medium 6.1 CVE-2021-24210 · published 2021-04-05
Open redirect in PhastPress (older than 1.111)
- Affected
- older than 1.111
- Fixed in
- 1.111
- Access needed (per CVSS)
- No login needed; someone on the site has to click a link or open a page
- Range from
- NVD analysis · score by NVD
Details from the advisory
There is an open redirect in the PhastPress WordPress plugin before 1.111 that allows an attacker to malform a request to a page with the plugin and then redirect the victim to a malicious page. There is also a support comment from another user one year ago (https://wordpress.org/support/topic/phast-php-used-for-remote-fetch/) that says that the php involved in the request only go to whitelisted pages but it's possible to redirect the victim to any domain.
Recent activity
- 2026-10-24 — latest release on wordpress.org (3.13).
- 2026-10-15 — Server-side request forgery (SSRF) disclosed (CVE-2026-3712), fixed in 3.11.
- 2025-12-23 — Path traversal / file read disclosed (CVE-2025-14388), fixed in 3.8.
- 2021-04-05 — Open redirect disclosed (CVE-2021-24210), fixed in 1.111.
Get an email when PhastPress has a new vulnerability
Free. We check the CVE feeds every day and email you only when a new issue for PhastPress (phastpress) is published or a fix ships. Unsubscribe in one click.
Browse vulnerabilities
Types found in this plugin: Server-side request forgery (SSRF) (1) · Path traversal and file read (1) · Open redirect (1)
Where this data comes from
- Version, last update, installs: wordpress.org/plugins/phastpress (Plugins API), fetched 2026-11-04.
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.
Badge for your site or docs (states facts with a date, not a verdict):
<a href="https://laskyr.com/plugins/phastpress"><img src="https://laskyr.com/plugins/phastpress/badge.svg" alt="PhastPress vulnerability status"></a>