Nginx Cache Purge Preload
Nginx Cache Purge Preload has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of October 2026. Their average CVSS score is 7.2, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Code Injection, behind 1 of the records (100%).
The one issue recorded for Nginx Cache Purge Preload has a vendor fix available, so running the current release closes it.
All of these findings were reported by vulnmode2. Nginx Cache Purge Preload is installed on roughly 200 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2025-6213Nginx Cache Purge Preload <= 2.1.1 - Authenticated (Administrator+) Remote Code Execution
Read the full analysisVulnerability Records

Nginx Cache Purge Preload
Author
Hasan CALISIR
NPP (Nginx Cache Purge Preload) lets you purge and preload your Nginx cache (FastCGI, Proxy, SCGI, uWSGI) straight from the WordPress dashboard. Built-in cache warming re-crawls your site after a purge, so pages are served from the Nginx cache again before visitors arrive. Purge a single URL or the whole cache using the fastest method your server supports, automate it on content changes, and control everything from the admin bar, REST API or WP-CLI. Supports fastcgi_cache, proxy_cache, scgi_cache and uwsgi_cache, and integrates with WooCommerce, Cloudflare APO and Redis Object Cache. Running Fail2Ban? NPP also works as a security dashboard for it, see below. 🛡️ Fail2Ban Dashboard Run Fail2Ban on your Nginx server? See what it blocks, right inside WordPress. Fail2Ban keeps blocking; NPP shows you who, from where, and how often. Live ban & unban feed with jail activity and repeat offenders Top Attack Countries world map Automatic network lookup: owner, ASN, country and abuse contact One-click abuse reports to the offending network Setup is three copy-paste steps in the Fail2Ban tab. See the FAQ below. 🖥️ Quick WP-CLI Manage your Nginx cache and Fail2Ban dashboard entirely from the command line. Perfect for automation, cron jobs, panels, and headless workflows. Purge: wp npp purge | wp npp purge --page-url=<url> Preload: wp npp preload | wp npp preload --page-url=<url> | wp npp preload --stop Fail2Ban: wp npp f2b status | wp npp f2b offenders --min-bans=3 | wp npp f2b events --type=ban --limit=20 --format=json Full command list: wp help npp | wp help npp <subcommand> 🔗 Resources Visit the NPP Main Development Repository – Docs, issues & contributions and more. Visit the safexec Main Development Repository – NPP’s privilege-dropping C wrapper. Explore NPP Containerized – Ready to run full stack Nginx Docker setup. Follow the Complete Setup & Guide – Nginx config, permissions, purge, preload and troubleshooting, step by step. Read the NPP Main Architecture – Technical deep dive article. Refer to the plugin’s Help tab for more deeper additional guidance. Features Purge All Nginx Cache: Completely clear all cached data stored by Nginx. Preload All Nginx Cache: Warm the Nginx cache with the most recent data for the entire website. HTTP Purge (ngx_cache_purge): When the Nginx cache module (ngx_cache_purge) is available, NPP uses it as the fastest purge path. Falls back gracefully to index and filesystem purge when the module is not present. INDEX Purge: Leverages the preload-generated URL → Filepath index to directly resolve and purge cache without filesystem traversal. If the cache exists and is valid, purge is executed immediately for near-instant performance. RG Purge: ripgrep-powered cache file lookup that replaces slow PHP directory scanning for single-URL purges, enabling near-instant deletes on large or FUSE-mounted caches. Automatically falls back to standard scan if unavailable. Auto Preload Nginx Cache: Automatically preloads the cache when Auto Purge is enabled for a POST/PAGE or after the Purge All action. Auto Purge Nginx Cache: Purge cache on Post/Page content changes, comment status updates, theme/plugin updates, or when compatible Cache Plugins trigger a purge. Nginx cache is preloaded automatically if Auto Preload is enabled (for the entire site or individual page). Purge Scope (Related Pages): Automatically purge related pages such as the Homepage, WooCommerce Shop page, and Category/Tag archives when a single URL is purged. Optionally preload those pages to keep the cache warm. Preload Feeds: Take full control of RSS/Atom feed caching. Decide site‑wide or per‑URL whether the main feed, per‑post comment feeds, and taxonomy RSS feeds are included in the preload process. Schedule Nginx Cache Purge & Preload via WP Cron: Automate the purge and preload process using WordPress Cron jobs. Proxy Support for Preload: Route preload requests through a proxy server for edge-case environments and containerized deployments. Live Preload Progress Monitoring: Watch the Nginx cache preload process in real time — complete with a dynamic progress bar, currently processed URL, 404 tracking, server load, and total completion time. Remote Nginx Cache Purge & Preload via REST API: Remotely trigger cache purging and preloading through REST API endpoints. Manual Nginx Cache Purge & Preload: Allow manual purging and preloading of cache through the table view in the Advanced Tab. Nginx Cache Analyzer: Full HIT/MISS cache analyzer dashboard, from the last preload crawl with what is currently stored in the Nginx cache. Instantly spot uncached pages and Purge or Preload them directly in the Advanced Tab. Preload All MISS: A targeted replacement for the expensive Preload All. Instead of purging and re‑caching everything (Preload All), it targets and populates only the cache entries that are not yet warmed. Perfect for sites with high cache coverage (>50%) where a full Preload All would be wasteful. On-Page Nginx Cache Purge & Preload: Manually purge and preload Nginx cache for the currently visited page directly from the frontend. Custom Cache Key Support: Define a regex pattern to parse URLs based on your custom _cache_key format. Monitor Plugin and Nginx Cache Status: Monitor plugin status, cache status, and Nginx status from the Status tab. Fail2Ban Dashboard: Live ban feed, repeat offenders, attack-country map, automatic IP network lookup and optional abuse reports. Fail2Ban keeps blocking; NPP adds the visibility. Cache Coverage Ratio: Live gauge in the WordPress dashboard widget showing the cache coverage ratio, based on the last preload snapshot. Refreshable on demand without a page reload. Cloudflare APO Sync: Automatically mirrors NPP purge actions to Cloudflare APO to keep edge cache synchronized with your Nginx cache. Redis Object Cache Sync: Coordinates cache invalidation between NPP and Redis Object Cache during NPP-driven operations. NPP Purge All and Preload workflows handle Redis flushing at the appropriate stage to ensure both cache layers stay aligned. WooCommerce Auto-Purge: Automatically purges Nginx cache when WooCommerce product stock quantity changes, stock status changes (in stock / out of stock / on backorder), or when an order is cancelled and stock is restored. WP-CLI Support: Manage Nginx cache directly from the command line. Purge and preload cache, view status reports, inspect logs, update settings, flush cache, and manage scheduled tasks without accessing the WordPress admin dashboard. Concurrent Purge Serialization: Atomic lock mechanism prevents simultaneous purge operations from colliding, ensuring cache integrity during concurrent admin actions or background events. Modular by Design: Easily integrate with external scripts and automation tools. User-Friendly Interface: Easy-to-use AJAX-powered settings, integrated into the WordPress admin bar and dashboard for quick access. Admin Notices and Logs: Receive notifications and view logs for plugin status and all cache-related actions within the WordPress admin area. Email Notifications: Receive email alerts upon completion of preload actions, with customizable templates to suit your needs. Credits This plugin is developed and maintained by Hasan CALISIR. Bundled libraries, all MIT licensed: DataTables (datatables.net), Tempus Dominus (github.com/Eonasdan/tempus-dominus), Popper.js (github.com/popperjs/popper-core), jsVectorMap (github.com/themustafaomar/jsvectormap), and flag-icons (github.com/lipis/flag-icons). Privacy Policy NPP does not collect usage telemetry. The optional anonymous usage reporting available before version 2.1.5, including its opt-in mechanism, has been removed. When configured, the optional Fail2Ban integration stores reported ban and unban events in your WordPress database. Network lookups and administrator-initiated emails may send data to third parties as described below. External services The optional Fail2Ban integration uses RIPEstat for network lookups. It also provides optional, administrator-initiated email features. RIPEstat Data API (stat.ripe.net) Provides network registration details, including network name, country, ASN, and abuse contacts, for public IP addresses reported as banned by Fail2Ban. Data sent: The public IP address reported as banned, sent to RIPEstat’s whois and abuse-contact lookup endpoints, plus the “sourceapp” identifier described below. When: From a background worker or WP-Cron after a ban event arrives and no cached result is available. These lookups require you to configure Fail2Ban to send events to the plugin’s webhook. Provider: RIPE NCC. Identifier: The plugin sends “npp-wp-plugin-fail2ban-monitor” by default. An administrator can optionally append a suffix, such as a domain or project name, under Fail2Ban > RIPEstat Lookups. The suffix is empty by default. Optional emails Abuse reports: Sent only when an administrator clicks Send or runs the WP-CLI command. The email contains the reported IP, ban timestamps and jail names, your site’s hostname and server IP, and the sender and contact details you configured. It goes to the abuse contact RIPEstat returns for that network. RIPEstat registration: When an administrator reviews and sends a registration email, the configured identifier and contact details are sent to the RIPEstat team at RIPE NCC. Neither abuse reports nor registration emails are sent automatically. Support For support and assistance, please contact Hasan CALISIR at hasan.calisir@psauxit.com. License This plugin is licensed under the GPLv2 or later.For more information, visit the plugin development page: Nginx Cache Purge Preload
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C