CVE-2025-6213

The Nginx Cache Purge Preload plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.1.1 via the 'nppp_preload_cache_on_update' function. This is due to insufficient sanitization of the $_SERVER['HTTP_REFERERER'] parameter passed from the 'nppp_handle_fastcgi_cache_actions_admin_bar' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.

• CWE-94

• https://github.com/psaux-it/nginx-fastcgi-cache-purge-and-preload
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3332176%40fastcgi-cache-purge-and-preload-nginx&new=3332176%40fastcgi-cache-purge-and-preload-nginx&sfp_email=&sfph_mail=#file15
• https://wordpress.org/plugins/fastcgi-cache-purge-and-preload-nginx/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/bbe8c101-5e0a-4ba7-8ff7-4c8ed01e9ef5?source=cve

Published

Jul 22, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-62124Improper Neutralization of Input During Web Page Generation …5.9
• CVE-2025-62125Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2025-62126Insertion of Sensitive Information Into Sent Data vulnerabil…5.3
• CVE-2025-62127Improper Neutralization of Input During Web Page Generation …5.9
• CVE-2025-62128Missing Authorization vulnerability in SiteLock SiteLock Sec…4.3
• CVE-2025-62129Missing Authorization vulnerability in Magnigenie RestroPres…5.3
• CVE-2025-62130Missing Authorization vulnerability in wpdiscover Accordion …4.3
• CVE-2025-62131Missing Authorization vulnerability in Strategy11 Team Tasty…4.3
• CVE-2025-62132Missing Authorization vulnerability in Strategy11 Team Tasty…4.3
• CVE-2025-62133Cross-Site Request Forgery (CSRF) vulnerability in manidorai…4.3
• CVE-2025-62134Cross-Site Request Forgery (CSRF) vulnerability in A WP Life…5.4
• CVE-2025-62135Improper Neutralization of Input During Web Page Generation …6.5