High severity7.2NVD Advisory· Published Jul 22, 2025· Updated Jun 17, 2026

CVE-2025-6213

Description

The Nginx Cache Purge Preload plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.1.1 via the 'nppp_preload_cache_on_update' function. This is due to insufficient sanitization of the $_SERVER['HTTP_REFERERER'] parameter passed from the 'nppp_handle_fastcgi_cache_actions_admin_bar' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Fastcgi Cache Purge And Preload Nginxreferences
Package: https://wordpress.org/plugins/fastcgi-cache-purge-and-preload-nginx
WordPress/Nginx Cache Purge Preloadllm-create
Range: <=2.1.1

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changesetnvd
wordpress.org/plugins/fastcgi-cache-purge-and-preload-nginx/nvd
www.wordfence.com/threat-intel/vulnerabilities/id/bbe8c101-5e0a-4ba7-8ff7-4c8ed01e9ef5nvd

News mentions

No linked articles in our index yet.

cvss	0.468
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000