GCVE - cpe:2.3:a:psauxit:nginx_cache_purge

Approved changes feed: RSS · Atom

cpe:2.3:a:psauxit:nginx_cache_purge_preload:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Psauxit (`00a62b0e-48e8-5435-a543-1da33b7daf30`)
Product	Nginx Cache Purge Preload (`9ff54b1b-92b2-5f7e-8c60-d3a052a2bf30`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-6213`	vulnerable	2026-06-08 07:43:14.553835	Nginx Cache Purge Preload <= 2.1.1 - Authenticated (Administrator+) Remote Code Execution HIGH (7.2) The Nginx Cache Purge Preload plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.1.1 via the 'nppp_preload_cache_on_update' function. This is due to insufficient sanitization of the $_SERVER['HTTP_REFERERER'] parameter passed from the 'nppp_handle_fastcgi_cache_actions_admin_bar' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server. Published: 2025-07-22T09:22:44.147Z Updated: 2026-04-08T17:18:37.182Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/bbe8c101-5e0a-4ba7-8ff7-4c8ed01e9ef5?source=cve https://wordpress.org/plugins/fastcgi-cache-purge-and-preload-nginx/ https://github.com/psaux-it/nginx-fastcgi-cache-purge-and-preload https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3332176%40fastcgi-cache-purge-and-preload-nginx&new=3332176%40fastcgi-cache-purge-and-preload-nginx&sfp_email=&sfph_mail=#file15	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open this panel to browse, search, copy or download the JSON record.