The WordPress Nginx Cache Purge Preload plugin, versions 2.1.1 and earlier, contains a code injection flaw (CWE-94). Unsanitized HTTP_REFERERER values passed through the admin bar handler allow an attacker who can authenticate as an Administrator or higher to supply arbitrary code that is then executed on the webserver. This flaw leads to full server compromise, giving attackers arbitrary command execution and data exfiltration capabilities.

WordPress sites that have installed the Nginx Cache Purge Preload plugin version 2.1.1 or earlier. Security teams should inventory any installation of this plugin and check the version number against the known vulnerable releases.

The CVSS score of 7.2 indicates a serious severity, while the EPSS score of less than 1% suggests the likelihood of exploitation is low at present. The vulnerability is not listed in the CISA KEV catalog, but because it requires only an authenticated Administrator account, the scope of potential damage remains high. The likely attack vector is a web request originating from a legitimate administrator session that supplies a crafted HTTP_REFERERER header through the WordPress admin interface. Once executed, the injected code runs with the same privileges as the web server, enabling persistent compromise.