PT-2025-30387 · WordPress · Nginx Cache Purge Preload

Cynau1T · Published 2025-07-22 · Updated 2025-07-22 · CVE-2025-6213

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nginx Cache Purge Preload plugin for WordPress versions through 2.1.1

Description The Nginx Cache Purge Preload plugin for WordPress is vulnerable to Remote Code Execution via the nppp preload cache on update function. This is due to insufficient sanitization of the $ SERVER['HTTP REFERERER'] parameter passed from the nppp handle fastcgi cache actions admin bar function. This allows authenticated attackers with Administrator-level access and above to execute code on the server.

Recommendations Nginx Cache Purge Preload plugin for WordPress versions through 2.1.1: Update to a version later than 2.1.1.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-6213

Affected Products

Nginx Cache Purge Preload

References · 12

• https://osv.dev/vulnerability/CVE-2025-6213 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6213 · Security Note
• https://github.com/psaux-it/nginx-fastcgi-cache-purge-and-preload · Note
• https://t.me/cveNotify/129781 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1947619927474540574 · Twitter Post
• https://wordpress.org/plugins/fastcgi-cache-purge-and-preload-nginx · Note
• https://t.me/CVEtracker/28363 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/bbe8c101-5e0a-4ba7-8ff7-4c8ed01e9ef5?source=cve · Note
• https://t.me/cvenotify/129781 · Telegram Post
• https://t.me/cvetracker/28363 · Telegram Post
• https://twitter.com/CVEnew/status/1947594456057643463 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3332176%40fastcgi-cache-purge-and-preload-nginx&new=3332176%40fastcgi-cache-purge-and-preload-nginx&sfp_email=&sfph_mail=#file15 · Note