CVE-2025-28993: Content No Cache Code Injection Vulnerability

CVE-2025-28993 Overview

CVE-2025-28993 is a code injection vulnerability in the Jose Mortellaro Content No Cache WordPress plugin. The flaw stems from improper control of code generation [CWE-94] and affects all plugin versions through 0.1.4. An unauthenticated attacker can invoke arbitrary functions remotely over the network without user interaction. The vulnerability carries a changed scope, meaning successful exploitation can impact components beyond the vulnerable plugin itself. Patchstack classifies the issue as an arbitrary function call vulnerability, allowing attackers to trigger sensitive PHP functions through plugin-exposed entry points.

Critical Impact
Unauthenticated network attackers can execute arbitrary function calls against WordPress sites running Content No Cache 0.1.4 or earlier, leading to broader confidentiality impact across the WordPress instance.

Affected Products

Jose Mortellaro Content No Cache WordPress plugin versions through 0.1.4
WordPress installations with the content-no-cache plugin activated
Any WordPress site exposing the plugin's vulnerable endpoint to the public internet

Discovery Timeline

2025-06-27 - CVE-2025-28993 published to the National Vulnerability Database
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-28993

Vulnerability Analysis

The vulnerability resides in the Content No Cache WordPress plugin developed by Jose Mortellaro. The plugin fails to properly validate or restrict function names passed through user-controlled input. As a result, attacker-supplied data flows into a dynamic function dispatch routine, enabling arbitrary function invocation. Because the scope is changed, exploitation can affect resources controlled by other components inside the WordPress runtime, including core APIs and other installed plugins. Patchstack categorizes the issue as an arbitrary function call vulnerability, a common subclass of PHP code injection where attackers leverage variable functions or call_user_func-style dispatchers to reach sensitive sinks.

Root Cause

The root cause is improper control of code generation [CWE-94]. The plugin accepts a function identifier from request parameters and passes it to a callable invocation without an allow-list. No authentication, capability check, or nonce verification gates this path. Any unauthenticated visitor can therefore reach the vulnerable handler.

Attack Vector

The attack vector is network-based with low complexity and no privileges required. An attacker sends a crafted HTTP request to the WordPress endpoint exposed by the plugin. The request carries a function name and optional arguments. The plugin then invokes that function in the PHP process context. Attackers can chain accessible PHP functions to read configuration, enumerate users, or pivot to additional impact depending on the WordPress environment. Refer to the Patchstack WordPress Vulnerability advisory for technical details.

Detection Methods for CVE-2025-28993

Indicators of Compromise

Unexpected HTTP requests to the content-no-cache plugin endpoints containing function-name parameters such as function, callback, or action
Unauthenticated POST or GET requests to /wp-content/plugins/content-no-cache/ paths from external IP addresses
PHP error log entries showing calls to sensitive functions originating from the plugin's handler files
Newly created administrative WordPress users or modified wp_options entries shortly after plugin requests

Detection Strategies

Inspect web server access logs for requests targeting content-no-cache plugin URLs with suspicious query parameters
Deploy WordPress security scanners or wpscan to enumerate the installed plugin version and flag versions at or below 0.1.4
Monitor PHP disable_functions violations and unexpected invocations of system, exec, file_get_contents, or wp_create_user triggered from the plugin process

Monitoring Recommendations

Alert on outbound network connections initiated by the PHP-FPM or web server process immediately following plugin requests
Track file integrity on wp-config.php, theme files, and the wp-content/uploads directory for unauthorized writes
Forward WordPress and web server logs to a centralized analytics platform for correlation against known attack patterns

How to Mitigate CVE-2025-28993

Immediate Actions Required

Identify all WordPress sites running the Content No Cache plugin version 0.1.4 or earlier and deactivate the plugin
Block external access to /wp-content/plugins/content-no-cache/ at the web application firewall or reverse proxy until a fix is verified
Rotate WordPress administrator credentials, secret keys in wp-config.php, and database passwords if exploitation is suspected
Audit the WordPress user table and scheduled cron events for unauthorized entries created after June 2025

Patch Information

No fixed version is listed in the NVD record at the time of publication. The advisory states the issue affects Content No Cache from unspecified versions through 0.1.4. Administrators should consult the Patchstack advisory and the plugin author's repository for updated releases, and remove the plugin if no patched version is available.

Workarounds

Uninstall the Content No Cache plugin entirely until a patched release is published
Restrict access to plugin endpoints using web server rules that deny unauthenticated requests to plugin PHP files
Apply virtual patching rules on a web application firewall to drop requests containing function-name parameters targeting the plugin
Use PHP disable_functions in php.ini to remove access to dangerous functions such as exec, system, passthru, and shell_exec

bash

# Configuration example - WAF rule to block plugin access
# Nginx location block to deny access to the vulnerable plugin path
location ~* /wp-content/plugins/content-no-cache/ {
    deny all;
    return 403;
}

# PHP hardening in php.ini
disable_functions = exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source