What the vulnerability does
01Description
The The Cache Purger plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.20. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently truncate the plugin's cache-purge audit log (wp-content/purge.log), destroying the entire cache-purge audit history. The tcp_log_purge nonce is rendered in the admin bar on frontend pages accessible to all authenticated users including subscribers, meaning any authenticated user possesses the nonce required to trigger the deletion.
Explanation of Vulnerability in Simple Terms
02Summary
The Cache Purger plugin for WordPress contains an authorization bypass that allows authenticated users with low privileges to modify cache settings they should not access. An attacker with a basic user account can alter cache behavior without proper permission checks. This affects all versions up to 2.3.20.
What an attacker can do
03Attacker Capabilities
Modify cache settings or purge cache without proper authorization.
Potential impact on your site
04Site Impact
Unauthorized users can disrupt site performance or expose cached data by manipulating cache behavior.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
July 16, 2026
CVE published
July 16, 2026
Record updated
