CVE-2026-15350

Name of the Vulnerable Software and Affected Versions The Cache Purger versions prior to 2.3.21

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can permanently truncate the cache-purge audit log located at wp-content/purge.log, resulting in the destruction of the entire audit history. This is possible because the tcp log purge nonce is rendered in the admin bar on frontend pages, providing all authenticated users with the necessary token to trigger the deletion.

Recommendations Update to a version later than 2.3.20.