The Cache Purger plugin for WordPress contains an authorization bypass (CWE‑862) that permits any authenticated user with subscriber-level access or higher to delete the plugin’s audit log file. The vulnerability arises because the plugin fails to verify that the requester is authorized to perform this action. When the authorized action is invoked, the wp‑content/purge.log file is permanently truncated, erasing the entire cache‑purge audit history. This flaw does not lead to code execution or disclosure of sensitive data, but it destroys the integrity of audit evidence.

All releases of The Cache Purger up to and including version 2.3.20 are impacted. Administrators should check that the installed plugin version does not fall within this range and plan an upgrade if necessary.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% shows a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only that the attacker be logged in with a Subscriber or higher role; the attacker can then obtain the required nonce from the admin bar presented on front‑end pages and trigger the deletion. Once triggered, the log is irrevocably erased, eliminating critical audit trail information.