WP Fastest Cache, a widely used WordPress caching plugin, mishandles the core account-activation page in every version through 1.5.3: it caches that page's response without respecting its no-store headers, the activation cookie, or the installing-state check, and writes the credential-bearing reply into a publicly reachable cache file. That means anyone who stumbles on the cached file can pull out a freshly registered user's plaintext username and twelve-character password without logging in at all. Site owners running this plugin should update immediately and clear any existing cache.
// source: nvd.nist.gov ↗