Far Future Expiry Header
Far Future Expiry Header has one disclosed vulnerability in the WordSec catalog, all reported in 2021; it is fixed as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).
The one issue recorded for Far Future Expiry Header has a vendor fix available, so running the current release closes it.
All of these findings were reported by apple502j. Far Future Expiry Header is installed on roughly 7,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2021-24799Far Future Expiry Header <= 1.4 - Plugin's Settings Update via Cross-Site Request Forgery
Read the full analysisVulnerability Records

Far Future Expiry Header
Author
mra13 / Team Tips and Tricks HQ
This plugin offers a few lightweight features to speed up your WordPress site without much hassle. Far Future Expiry When the feature is enabled, this plugin will modify your .htaccess file by inserting code which will add expires headers for common static file types. Expiry header specifies a time far enough in the future so that browsers won’t try to re-fetch images, CSS, javascript etc files that haven’t changed (this reduces the number of HTTP requests) and hence the performance improvement on subsequent page views. Gzip Compression You can also enable Gzip compression on your site using this plugin. Gzip compression will speed up your WordPress site by compressing the page output and sending it to your visitors browser. When enabled, the plugin will do gzip compression if the visitor’s browser can handle it. This feature may conflict with a few other plugins. So disable this feature if you need to use a plugin which doesn’t work with gzip compression. Usage To use this plugin do the following: 1) Ensure that the “mod_expires” module is enabled from your host’s main configuration file 2) Check with your hosting provider or if you have access to the httpd.conf file the following line should be uncommented: LoadModule expires_module modules/mod_expires.so 3) Enable the “Far Future Expiration” checkbox 4) Set the number of days till expiry 5) Select the file types you wish to enable the “far future expiration” feature for by using the checkboxes in the “File Types” section NOTE: When you use this plugin, the file selected file types are cached in the browser until they expire. Therefore you should not use this on files that change frequently. More details can be found on the plugin’s documentation page
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C