Authorization Bypass in Cache Purger WordPress Plugin

Executive Summary

The Cache Purger plugin for WordPress has an authorization bypass flaw in versions up to 2.3.20. It fails to verify user permissions before allowing actions. Authenticated attackers with subscriber-level access or higher can permanently delete the plugin's cache-purge audit log file, erasing all cache-purge history. The vulnerability exists because a required security token (nonce) is exposed in the admin bar on frontend pages accessible to all authenticated users.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized modifications to the purge.log file in wp-content. Inspect WordPress admin bar for the tcp_log_purge nonce on frontend pages accessible to subscribers. Review WordPress user roles with subscriber access or higher for unusual activity.

Useful 0 Not Useful 0

Impact Analysis

If you use the vulnerable Cache Purger plugin, an attacker could delete your cache-purge audit logs. This would erase records of cache clearing operations, potentially hiding evidence of malicious activity or system maintenance. While it doesn't directly compromise data, it removes forensic data that could be important for security investigations or compliance audits.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by removing audit logs that may be required for regulatory purposes. GDPR and HIPAA both emphasize data integrity and audit trails. Deleting cache-purge logs might hinder your ability to demonstrate proper data handling or system maintenance, potentially violating record-keeping requirements in these standards.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Cache Purger plugin to the latest version beyond 2.3.20. Remove the tcp_log_purge nonce from frontend admin bar. Restrict subscriber-level access to sensitive functions. Monitor purge.log for unauthorized truncation attempts.

Useful 0 Not Useful 0