CVE-2025-6213: Nginx Cache Purge Preload RCE Vulnerability

CVE-2025-6213 Overview

CVE-2025-6213 is a Remote Code Execution (RCE) vulnerability affecting the Nginx Cache Purge Preload plugin for WordPress in all versions up to and including 2.1.1. The flaw resides in the nppp_preload_cache_on_update function, which fails to sanitize the $_SERVER['HTTP_REFERERER'] parameter passed from the nppp_handle_fastcgi_cache_actions_admin_bar function. Authenticated attackers holding Administrator-level access or higher can leverage this weakness to execute arbitrary code on the underlying server. The vulnerability is classified under CWE-94: Improper Control of Generation of Code.

Critical Impact
Authenticated administrators can achieve arbitrary code execution on the WordPress host, leading to full server compromise.

Affected Products

Nginx Cache Purge Preload plugin for WordPress, all versions up to and including 2.1.1
WordPress installations with the plugin active and Nginx FastCGI cache integration enabled
Sites where untrusted users hold Administrator-level accounts

Discovery Timeline

2025-07-22 - CVE-2025-6213 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6213

Vulnerability Analysis

The Nginx Cache Purge Preload plugin exposes administrative actions through the WordPress admin bar to manage FastCGI cache operations. The nppp_handle_fastcgi_cache_actions_admin_bar function reads the HTTP Referer header from the request and forwards the value to nppp_preload_cache_on_update without performing adequate sanitization or validation. Because the downstream function treats the attacker-controlled string as input that influences code execution paths, an authenticated user with Administrator privileges can craft a request whose Referer header carries an attacker payload. The resulting flow allows the payload to be interpreted by the server, satisfying the conditions for code injection under [CWE-94].

Root Cause

The root cause is missing input validation on a server-supplied superglobal. The plugin reads $_SERVER['HTTP_REFERERER'] (the HTTP Referer header), which is fully attacker-controlled, and passes it into a function that ultimately drives a command or code construction path. No allow-list, escaping routine, or type check is applied before the value reaches the sensitive sink. Trusting client-supplied headers as if they were internally generated values is the underlying design flaw.

Attack Vector

Exploitation requires the attacker to authenticate as an Administrator. From there, the attacker sends an HTTP request to a WordPress endpoint that triggers nppp_handle_fastcgi_cache_actions_admin_bar, while supplying a crafted Referer header. The header value flows into nppp_preload_cache_on_update, where the unsanitized data is incorporated into a code execution context. The result is arbitrary code execution under the privileges of the PHP-FPM or web server worker process. See the Wordfence Vulnerability Report and the WordPress Plugin Changeset for the patch diff and additional technical context.

No verified proof-of-concept code is published in the enriched data set; refer to the GitHub repository for source-level review.

Detection Methods for CVE-2025-6213

Indicators of Compromise

Unexpected outbound connections originating from the PHP-FPM or web server process after administrator-initiated cache actions.
Web server access logs showing requests to FastCGI cache admin bar endpoints with anomalous or unusually long Referer header values.
New or modified PHP files in the WordPress webroot, wp-content/uploads/, or plugin directories shortly after a cache preload action.
Creation of new administrator users, scheduled tasks (wp_cron entries), or unfamiliar shell utilities running under the web server account.

Detection Strategies

Inspect HTTP request logs for the FastCGI cache admin bar action endpoints and flag any request whose Referer header contains shell metacharacters such as `, $(, ;, |, or &&.
Monitor WordPress audit trails for administrator account logins from unusual geolocations or IP addresses that immediately invoke plugin-managed cache operations.
Correlate web server child process spawns (sh, bash, curl, wget, python) with the parent PHP-FPM worker to identify command execution out of band from normal request handling.

Monitoring Recommendations

Enable verbose logging on the Nginx Cache Purge Preload plugin and forward WordPress and web server logs to a centralized log analytics platform for retention and search.
Establish a baseline for legitimate administrator-driven cache preload events and alert on deviations in frequency, source IP, or referrer content.
Continuously inventory installed WordPress plugins and their versions to surface hosts still running 2.1.1 or earlier.

How to Mitigate CVE-2025-6213

Immediate Actions Required

Update the Nginx Cache Purge Preload plugin to a version later than 2.1.1 on every WordPress site where it is installed.
Audit all WordPress Administrator accounts, remove unused accounts, and enforce multi-factor authentication on the remaining ones.
Rotate WordPress administrator passwords and any API keys or secrets stored within the affected installation if exploitation is suspected.
Review the webroot for unexpected PHP files, modified plugin files, and newly created cron jobs.

Patch Information

The vendor has issued a fix tracked under the WordPress Plugin Changeset 3332176. Administrators should install the latest release from the official WordPress Plugin Page. Refer to the Wordfence Vulnerability Report for fixed version details.

Workarounds

Deactivate and delete the plugin until it can be upgraded if a patched release cannot be deployed immediately.
Restrict access to /wp-admin/ to known administrator source IP ranges using web server access controls or a Web Application Firewall (WAF).
Configure a WAF rule to strip or reject inbound Referer headers containing shell metacharacters when targeted at WordPress admin endpoints.

bash

# Example Nginx rule to drop suspicious Referer headers to wp-admin
location ^~ /wp-admin/ {
    if ($http_referer ~* "[`$();|&]") {
        return 403;
    }
    # existing wp-admin handling...
}