Purge Varnish Cache
Purge Varnish Cache has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).
The one issue recorded for Purge Varnish Cache has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Nguyen Xuan Chien. Purge Varnish Cache is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2025-58807Purge Varnish Cache <= 2.6 - Cross-Site Request Forgery
Read the full analysisVulnerability Records
Purge Varnish Cache
Author
Dsingh
Purge Varnish Cache provides integration between your WordPress site and multiple Varnish Cache servers. Purge Varnish Cache sends a PURGE request to the URL of a page or post every time based on configured actions and trigger by site administrator. Varnish is a web application accelerator also known as a caching HTTP reverse proxy. Features: * Support on all varnish versions of 3.x, 4.x, 5.x and 6.x * One time configuration. * admin-socket integration and Varnish admin interface for status. * unlimited number of Varnish Cache servers. * Custom URLs purge. * User interface for manual purge. * Single click entire cache purge. * Debugging. * Actively maintained. Requirements: Apache sockets module/extention should be enabled. Purpose: The main purpose of developing this plugin is to deliver updated copy of content to end user without any delay. Enhancement Request: For any further enhancement, please mail me at dev.firoza@gmail.com
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C