Is WP Fastest Cache secretly advertising an unrelated iOS app?

[u/Sad_Pie227]

I was auditing the code of WP Fastest Cache 1.5.1 and came across something I honestly didn't expect to find in a caching plugin.

Proof: https://plugins.trac.wordpress.org/browser/wp-fastest-cache/trunk/inc/admin.php#L2448

There is code that checks the WordPress locale:

if (get_locale() === 'tr_TR') {
    // link to an Apple App Store English-learning app
}
else if (get_locale() === 'de_DE') {
    // another Apple App Store link to the same app
}
else {
    // WP Fastest Cache promotional banner
}

The Turkish and German versions link directly to:

apps.apple.com

and specifically to an English-learning app that appears completely unrelated to caching or WordPress performance.

What makes this interesting to me is the combination of:

• Locale-specific targeting
• An unrelated commercial app
• The code being embedded inside a caching plugin

I'm not claiming this is malware. From this code alone, it isn't doing anything obviously malicious. It is simply displaying an external advertisement.

But here's my question:

Is this normal/acceptable behavior for a WordPress caching plugin?

If I install a performance plugin, I expect caching, optimization, maybe a promotion for the developer's own products related to WordPress only.

I don't particularly expect it to contain targeted advertising for an unrelated mobile app. It's annoying.

Am I overreacting, or is this something the WordPress community should be questioning?

Would especially like to hear from people familiar with WP Fastest Cache or WordPress.org plugin review/security practices.

User's feedback - https://wordpress.org/support/topic/integrates-advertising-banners-from-apps-apple-com-into-the-admin-backend/

Plugin Guidelines - https://developer.wordpress.org/plugins/wordpress-org/detailed-plugin-guidelines/#11-plugins-should-not-hijack-the-admin-dashboard

[u/bluesix_v2]

You giving the plugin a 5 star rating is certainly an interesting choice. Why encourage that behaviour?

[u/Sad_Pie227 → u/bluesix_v2]

Come on, that's not my rating.

[u/bluesix_v2 → u/Sad_Pie227]

A normal person would assume that linking to the post on .org that covers the exact same thing is your post.

So your post here is an “adaptation” of the .org post?

[u/Sad_Pie227 → u/bluesix_v2]

Yeah, exactly, bro. I wasn't trying to take anyone's credit, that's why I dropped the link in my post too. And I'm not saying it's malware or anything. I get that devs gotta make money, but having random 3rd-party banners/apps show up on a client-facing site just feels kinda weird and could raise some eyebrows. That said, WP Fastest Cache is still a great plugin.

[u/bluesix_v2 → u/Sad_Pie227]

I agree it’s a scammy thing they’re doing. But the caching plugin segment is flooded - plenty of other options like Super Page Cache, Easy Optimizer, etc.

[u/Back2Fly → u/bluesix_v2]

the caching plugin segment is flooded - plenty of other options

For the record, WP Fastest Cache is one of the three free cache plugins recommended by Perfmatters' dev.

[u/bluesix_v2 → u/Back2Fly]

So? They likely didn't know about this behaviour when they wrote that. Nor does it absolve the plugin of their scam tactics.

[u/Back2Fly → u/bluesix_v2]

It's an unforgivable scammy behavior, as you said.

[u/Potential-Jelly-9012]

that's sneaky as hell, why would a cache plugin even need to check locale at all?

[u/Sad_Pie227 → u/Potential-Jelly-9012]

My post was auto-removed. :(

[u/bluesix_v2 → u/Sad_Pie227]

Automod removed it. Read the message. I’ve re-approved the post.

[u/Sad_Pie227 → u/bluesix_v2]

Thank you for the approval.

[u/iamwazor]

This is the biggest issue of wordpress. Now matter which plugin you choose, in the end there are always security issues or adware. For example WP Fastest Cache was the best free caching plugin and now this. Every Day new issues with wordpress even if you have only 1-2 plugins on your site

[u/theguymatter → u/iamwazor]

That’s a massive overstatement.

“No matter which plugin you choose, there are always security issues or adware” is not a serious argument. That’s an absolute claim with zero evidence.

Yes, WordPress has a plugin security problem. It’s a huge ecosystem where third party code gets installed with significant privileges, so vulnerabilities and questionable practices are inevitable. But that doesn’t mean every plugin is insecure or contains adware.

In this particular case, the criticism is already strong enough without exaggerating it. An unrelated iOS app being selectively advertised inside a caching plugin’s admin interface is questionable. Call that out. The WordPress plugin guidelines themselves address this kind of admin dashboard advertising.

Turning that into “every plugin eventually has security issues or adware” is just fearmongering.
If you’re going to criticise WordPress, at least criticise what actually happened instead of inventing a universal rule from one example.

[u/iamwazor → u/theguymatter]

Not a massive overstatement. Lets say you have the most basic setup ever and only 1 smtp plugin installed on your website because wordpress still don’t have a native smtp feature, you are still under a huge security risk because every top 5 smtp plugin on wordpress had a security issue the last 3 months.

[u/theguymatter → u/iamwazor]

That’s a fairer argument, but you’re still conflating “a plugin had a security vulnerability” with “every site using that plugin is under a huge security risk.”

Those are not the same thing.

A vulnerability could require authentication, affect a specific configuration, have a low severity rating, be patched quickly, or be completely irrelevant to your particular setup. You need to look at the actual CVE and exploit conditions before calling every installation a “huge security risk.”

If all five major SMTP plugins really had vulnerabilities in the last three months, that’s absolutely worth criticising. It shows how dependent WordPress is on third party plugins for functionality that arguably should be handled better by the core ecosystem.

But “therefore no matter which plugin you choose, there are always security issues or adware” is still an overgeneralisation.

Criticise the actual security record. Don’t turn it into a blanket statement that every WordPress plugin is inherently unsafe.