What is the CVSS score of CVE-2026-15350?

CVE-2026-15350 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

The Cache Purger CVE-2026-15350

EUVD-2026-44884 MEDIUM

Missing Authorization (CWE-862)

2026-07-16 Wordfence

GHSA-fpxv-63pw-m29m

WordPress Authentication Bypass Wordpress Plugin The Cache Purger

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network vector and low complexity confirmed by nonce self-service via admin bar; PR:L reflects mandatory subscriber authentication; only audit log integrity is affected, no confidentiality or system availability loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 09:01 vuln.today

CVE Published

Jul 16, 2026 - 07:51 cve.org

MEDIUM 4.3

DescriptionCVE.org

The The Cache Purger plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.20. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently truncate the plugin's cache-purge audit log (wp-content/purge.log), destroying the entire cache-purge audit history. The tcp_log_purge nonce is rendered in the admin bar on frontend pages accessible to all authenticated users including subscribers, meaning any authenticated user possesses the nonce required to trigger the deletion.

AnalysisAI

Authorization bypass in The Cache Purger WordPress plugin (all versions through 2.3.20) allows any subscriber-level authenticated user to permanently destroy the plugin's entire cache-purge audit log (wp-content/purge.log). The root cause is that the tcp_log_purge nonce - the only credential required to trigger log deletion - is rendered in the WordPress admin bar on frontend pages visible to all authenticated users, including the lowest-privilege subscribers, making the authorization check trivially bypassable. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

The Cache Purger (CPE: cpe:2.3:a:kevp75:the_cache_purger:*:*:*:*:*:*:*:*) is a WordPress plugin that manages cache purging and maintains a plaintext audit log at wp-content/purge.log. The vulnerability is classified as CWE-862 (Missing Authorization). WordPress plugins are expected to verify both nonce validity (replay protection) and user capability (authorization) before executing privileged actions. This plugin correctly generates and checks a nonce (tcp_log_purge), but fatally exposes that nonce in the admin bar rendered on all frontend pages, bypassing its intended access control function entirely. The log-truncation handler at kp-cache-purge-common.php (L223, L242, L99) and the admin interface at kp-cache-purge-admin.php (L132) lack any capability check (e.g., current_user_can()) beyond nonce verification, so any WordPress-authenticated session that possesses the nonce - which is every authenticated user by design - can trigger permanent log deletion.

RemediationAI

Update The Cache Purger plugin to the version released after changeset 3603867 in the WordPress plugin repository; the precise version number following 2.3.20 is not independently confirmed from the available data, so administrators should install the latest available version from the WordPress plugin directory and verify it post-dates this changeset. If an update is not immediately available, the most effective compensating control is to disable the plugin entirely until a patched release is confirmed, as no configuration toggle can prevent the nonce exposure embedded in the admin bar. As a secondary mitigation, administrators can restrict subscriber-level user registration and enforce the principle of least privilege - reducing the number of authenticated sessions that can trigger the action - but this does not eliminate the vulnerability. Monitoring for unexpected truncation of wp-content/purge.log can serve as a detective control. The Wordfence advisory and the vulnerable code paths are documented at the references listed in the plugin's trac repository.