Cache control by Cacholong
Cache control by Cacholong has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; 1 is fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 4.9, and the most serious one scores 5.5 out of 10. 2025 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Cross-Site Scripting.
1 of the records (50%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.
2 independent researchers contributed these findings, one record each. Cache control by Cacholong is installed on roughly 500 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2025-31763Cache control by Cacholong <= 5.4.1 - Cross-Site Request Forgery
Read the full analysisVulnerability Records

Cache control by Cacholong
Author
Preliot
“Cache control by Cacholong” plugin automates purging of Nginx FastCGI cache on your Nginx server(s). It is a backend plugin that is able to: Purge Nginx FastCGI cache. Purge cache automatically, manually, with WordPress cronjobs and WP-CLI. Purge caches on one or more servers (See hosts.json section for more details). Use commandline (WP-CLI) to purge caches or reset to factory settings. Allow purging of other cached items (see Settings > Cache control). Inform user of purge status. Support for single site and network sites Support for WP-CLI Support for WPML (including language negotiation type domain) When will it purge? This plugin will work with default and custom post types. It will purge on a save, regular update, quick edit update, slug change, delete and undelete. The user is informed with one or more messages. There are a few caveats: When a user is using the Gutenberg editor, purge messages will not be displayed. When the user uses “Quick edit” and “Updates” the post, no messages will be displayed, because there’s no page refresh. Those messages will be shown on the next request. It is possible to purge with WordPress cronjobs. Adjust the ‘Cronjob settings’ to perform a daily purge of caches. You can also purge items manually. Go to the WordPress dashboard and navigate to: Settings > Cache control > purge single item Settings > Cache control > purge all caches Admin Toolbar > purge all caches Settings File with hosts (JSON): File with information about one or more hosts for this WordPress installation. See hosts.json section for more details. Purge settings default post types: Select one or more options when purging a default post type. Possible to purge post url (default), home page, all connected WordPress categories or all caches. Purge settings default custom type(s): Select one or more options when purging a custom post type. Possible to purge post url (default), home page, all connected WordPress categories or all caches. Cronjob Settings Cronjob purging: Enable or disable cronjob purging. Cronjob time of each day: Enter HH:MM in 24 hour notation for cronjob time of day. Will fallback to 00:00 when wrong format is given. Purge caches Select caches to purge on given cronjob time. hosts.json Hosts.json is a JSON file with information about one or more servers for this WordPress installation. Remember that this file must contain information about all servers, including the one with this plugin. Default path is: wp-content/uploads/cacholong-cache-control/hosts.json. Here is an example of a hosts.json file: {"servers": [ {"name": "server1", "ip": "127.0.0.1", "fastcgi": false}, {"name": "server2", "ip": "127.0.0.2", "fastcgi": true}, ] } Each line contains information about one server. Parameters: name (string) Name of host, something to identify this server. ip (string) IP address of server or full url. Format: scheme://host:port/path fastcgi (bool) Server user Nginx FastCGI (true) or not (false) When there is no hosts.json or the path is invalid, this plugin assumes the following: {"servers": [ {"name": "localhost", "ip": "127.0.0.1", "fastcgi": true} ] } How does it work “Cache control by Cacholong” empties partial or full cache for Nginx FastCGI cache. WordPress HTTP API is used to make (post) request to specific urls to trigger purges. Based on the http header responses this plugin determines if a purge is successful or not. The user is informed with messages, which are loaded after a purge and page refresh. There are several settings to tweak purging, see Settings > Cache control. WP-CLI There are several commands available for the commandline with wp-cli. Commands generate text output which can be suppressed with –quiet. When an error occurs, text will always be displayed. WP-CLI exit codes Exit codes are 0 (no errors) or 1 (generic error). WP-CLI examples Purge command with all arguments: wp cacholong_cc purge [--cache=<cache>] [--ips=<ips>] Purge Nginx FastCGI: wp cacholong_cc purge --cache=fastcgi Purge all caches: wp cacholong_cc purge --cache=all wp cacholong_cc purge Purge all caches for ip address 127.0.0.1 and 127.0.0.2: wp cacholong_cc purge --ips=127.0.0.1,127.0.0.2 Factory reset options for given site_id or current blog if no site_id is given: wp cacholong_cc factory_reset [--site_id=site_id] Debug Plugin will log basic purge information when WP_DEBUG is true (can be set in wp-config.php). Logs information in file wp-content/cacholong-cache-control.log. Plugin will log wp_remote_request details when CACHOLONG_CACHE_DEBUG_HTTP_API_REQUEST is true (can be set in wp-config.php). Logs information in file wp-content/cacholong-cache-control.log.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C