What the vulnerability does
01Description
The Nginx Cache Purge Preload plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.1.1 via the 'nppp_preload_cache_on_update' function. This is due to insufficient sanitization of the $_SERVER['HTTP_REFERERER'] parameter passed from the 'nppp_handle_fastcgi_cache_actions_admin_bar' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.
Explanation of Vulnerability in Simple Terms
02Summary
The Nginx Cache Purge Preload plugin versions 2.1.1 and earlier contain a code injection vulnerability that allows authenticated administrators to execute arbitrary PHP code on the site. An attacker with high-level administrative privileges can inject malicious code through the plugin's input handling, leading to full compromise of the site's integrity and confidentiality. This vulnerability requires administrative access to exploit.
What an attacker can do
03Attacker Capabilities
Run arbitrary PHP code on the site with full access to data and functionality.
Potential impact on your site
04Site Impact
An admin account compromise could allow an attacker to execute code, steal data, or modify site content.
Conditions required to exploit
05Prerequisites
Attacker must have high-level administrative privileges on the site.
Key dates
06Disclosure timeline
July 22, 2025
CVE published
April 8, 2026
Record updated
