A newly disclosed vulnerability in the Cache Enabler WordPress plugin can allow unauthenticated attackers to delete files and directories on affected websites, according to a CVE published on 1 October 2026.
The issue, tracked as CVE-2026-19253, affects Cache Enabler versions earlier than 1.8.17. Cache Enabler is developed by KeyCDN and is used on more than 100,000 WordPress installations, making the disclosure relevant to a sizeable group of business websites.
The flaw sits in the plugin’s cache-clearing functionality. The published CVE says affected versions do not properly validate a URL before using it to construct a filesystem path. Under the vulnerable conditions described in the advisory, that path can escape the intended cache directory and allow files or directories elsewhere on the WordPress installation to be removed.
That matters because this is not simply a performance bug. A successful attack could damage a live website by deleting files needed by WordPress, a theme, a plugin or another part of the site’s application stack. Depending on what is removed, the result could range from broken functionality to a partial or complete outage.
The vulnerability was publicly published today, although the fixed Cache Enabler version was already available before the disclosure. The official WordPress plugin changelog states that version 1.8.17 fixes unauthenticated arbitrary file and directory deletion when clearing the page cache by URL.
Website owners running Cache Enabler should therefore check the installed version rather than assuming that a plugin is safe because WordPress shows no obvious warning on the front end. Sites still running a version below 1.8.17 should be treated as requiring an urgent update.
Cache plugins have unusually broad contact with a WordPress site’s filesystem because their job is to generate, store and remove cached files. That does not make caching plugins inherently unsafe, but it means path handling and cache-purge routines have to be tightly controlled. In this case, the weakness has been classified as external control of a file name or path.
The disclosure also includes a public proof-of-concept reference. That increases the importance of patching promptly because technical details that demonstrate the vulnerable behaviour are no longer limited to the original researchers and maintainers.
For UK businesses, the immediate priority is straightforward: confirm whether Cache Enabler is installed, check the version, take a current backup and update to 1.8.17 or later. On sites that handle enquiries, bookings, payments or customer accounts, the update should be followed by basic functional testing rather than treating a successful WordPress update message as proof that everything is working.
A controlled WordPress maintenance process is especially important for business-critical sites. Plugin updates can close security holes, but updates can also introduce compatibility problems with themes, page builders, WooCommerce or custom code. A backup, a known rollback point and a short test of key customer journeys reduce the risk on both sides.
Site owners should also review whether there are any signs of unexplained file loss or recent instability. Unexpected 500 errors, missing plugin files, broken layouts, failed forms or sudden white screens can have many causes and do not prove exploitation, but they are worth investigating if they appeared while a vulnerable version of Cache Enabler was active.
If a site has already stopped working, repeatedly reinstalling plugins or restoring random files can make diagnosis harder. The safer approach is to preserve logs where possible, identify what changed and then decide whether a targeted repair or a clean restore is appropriate. Core Web UK’s emergency website fixes service covers urgent WordPress failures, including security problems, plugin conflicts and broken sites after updates.
The disclosure is also a reminder that plugin popularity is not a substitute for patch management. Cache Enabler is a well-established performance plugin with a large install base, yet a serious flaw can still emerge in mature software. The practical defence is to keep an accurate plugin inventory, monitor security disclosures and apply fixes in a controlled way.
Businesses that only log into WordPress when they need to change a page can easily miss this type of issue. A site may continue to look normal while an outdated plugin remains exposed. Regular checks for pending security updates, failed backups and unusual behaviour should form part of a basic WordPress maintenance checklist.
Cache Enabler 1.8.17 is the version identified by the official changelog as containing the fix. Website owners using the plugin should verify that version or a later release is installed, then test the site after updating and keep a recoverable backup available in case any unrelated compatibility issue appears.
