WP Manifestindependent plugin directory
manifest / performance / umich-cloudflare

University of Michigan: Cloudflare Cache WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+ #4 in Performance & Caching

Wordpress Cloudflare plugin

★ 6stars
1krelease downloads
≈140active sites
1.1.0latest · 4mo ago

Install

Download umich-cloudflare-1.1.0.zip From the 1.1.0 release on GitHub, Jun 25, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/its-cloudflare/umich-cloudflare/releases/download/1.1.0/umich-cloudflare-1.1.0.zip
Updates itself. It ships its own updater (Update URI header), so new versions appear under Dashboard → Updates.

U-M Cloudflare Cache Purge Manager

Provides easy and automatic ability to purge cloudflare cache for your whole site, section, or a page. Also adds metabox to override TTL and Disable cache for a specific page/post/cpt.

This requires that you have an existing CloudFlare API key.

Install

WP Admin/Dashboard Method

This requires that your site has write access to the plugins folder.

  1. Download the latest package (e.g. umich-cloudflare-x.x.x.zip)
  2. Go to WP Admin/Dashboard -> Plugins -> Add New -> Upload Plugin
  3. Select the downloaded zip file and Upload
  4. Activate Plugin
  5. Configure plugin settings (WP Admin/Dashboard -> Settings -> U-M: Cloudlfare
  6. Add your API Key (Provided by ITS or your units Cloudflare manager)

    Manual Method

  7. Download the latest package (e.g. umich-cloudflare-x.x.x.zip)
  8. Extract zip
  9. Upload the umich-cloudflare folder to wp-content/plugins/ folder in your site
  10. Activate Plugin
  11. Configure plugin settings (WP Admin/Dashboard -> Settings -> U-M: Cloudlfare
  12. Add your API Key (Provided by ITS or your units Cloudflare manager)

Custom Integrations

Filters

umich_cloudflare_settings

Override the plugins saved API settings.

add_filter( 'umich_cloudflare_settings', function( $settings ){
    // your code here to modify settings as necessary

    return $settings;
});

umich_cloudflare_menu_purge_page

Ability to disable the Admin Menu Page Purge menu item.

add_filter( 'umich_cloudflare_menu_purge_page', '__return_false' );

umich_cloudflare_menu_purge_section

Ability to disable the Admin Menu Section Purge menu item.

add_filter( 'umich_cloudflare_menu_purge_section', '__return_false' );

umich_cloudflare_admin_form_settings

Customize which settings should be available for management. Useful in complex wordpress environments.

add_filter('umich_cloudflare_admin_form_settings', function( $settings ){
    $settings['apikey']             = false;
    $settings['zone']               = false;
    $settings['ttl']                = false;
    $settings['ttl_browser']        = false;
    $settings['ttl_static']         = false;
    $settings['ttl_static_browser'] = false;
    return $settings;
});

Pantheon Filters

umich_cloudflare_pantheon_surrogate_keys

Adjust which surrogate keys are issued in the request.

add_filter( 'umich_cloudflare_pantheon_surrogate_keys', function( $keys ){
    $keys[] = 'my-custom-key';

    return $keys;
});

Actions

umich_cloudflare_purge_page

Called before cloudflare purge page request.

$paths: paths to be purged
add_action( 'umich_cloudflare_purge_page', function( $paths ){
    // do something
});

umich_cloudflare_purge_all

Called before cloudflare purge all request

$paths: paths to be purged
add_action( 'umich_cloudflare_purge_all', function( $paths ){
    // do something
});

umich_cloudflare_admin_settings_save

Called after settings validation and before settings save.

$settings:  reference of the form settings
$hasErrors: reference of the forms boolean error flag
add_action( 'umich_cloudflare_admin_settings_save', function( $settings, $hasErrors ){
    // custom action code here
    if( !$hasErrors ) {
        if( $settings['apikey'] ) {
            // do something
        }
    }
});

Custom Purge Integration

There are some public functions that can be called to perform custom cache purging integrations.

UMCloudflare::purgePage( $path ) Purge a specific url from the cache.

// RETURNS: true on success, false on failure
UMCloudflare::purgePage( '/path-to-my-page/' );

UMCloudflare::purgeAll( $paths ) Purge everything that starts with a path

// RETURNS: true on success, false on failure
UMCloudflare::purgeAll('/');

Releases

16 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.1.0 latest
Jun 25, 2026 4mo ago
umich-cloudflare-1.1.0.zip
216
Sep 25, 2025 1 year ago
umich-cloudflare-1.0.14.zip
229
Sep 23, 2025 1 year ago
umich-cloudflare-1.0.13.zip
38
May 21, 2025 1 year ago
umich-cloudflare-1.0.12.zip
150
Jan 24, 2025 1 year ago
umich-cloudflare-1.0.11.zip
143
Oct 28, 2024 1 year ago
umich-cloudflare-1.0.10.zip
80
Oct 23, 2024 2 years ago
umich-cloudflare-1.0.9.zip
32
Sep 25, 2024 2 years ago
umich-cloudflare-1.0.8.zip
39
Sep 24, 2024 2 years ago
umich-cloudflare-1.0.7.zip
15
Sep 12, 2024 2 years ago
umich-cloudflare-1.0.6.zip
34
Aug 8, 2024 2 years ago
umich-cloudflare-1.0.5.zip
26
Jul 11, 2024 2 years ago
umich-cloudflare-1.0.4.zip
12
Jun 19, 2024 2 years ago
umich-cloudflare-1.0.3.zip
14
Jun 11, 2024 2 years ago
umich-cloudflare-1.0.2.zip
8
Apr 26, 2024 2 years ago
umich-cloudflare-1.0.1.zip
6
Apr 18, 2024 2 years ago
umich-cloudflare-1.0.0.zip
2

Active-site estimate ≈140 comes from the median of recent superseded releases. Method.

D+ grade

Security

University of Michigan: Cloudflare Cache 1.1.0 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
1.1.0
Findings
2
Worst severity
high
Content hash
3167afae4228a59a17f1f958…

Findings

  • high Unauthenticated Cloudflare zone purge via nopriv AJAX nonce oracle

    missing_auth

    wp_ajax_nopriv_umcloudflare_clear and wp_ajax_umcloudflare_clear both point at UMCloudflare::ajaxOnPurge. The handler never calls current_user_can. The only gate is check_ajax_referer('umich-cloudflare-nonce','nonce', false) — the third argument false means a missing/invalid nonce does not die. After the if, the method always sets $return['nonce'] = wp_create_nonce('umich-cloudflare-nonce') and json_encodes it. WordPress uid-0 nonces are valid for all logged-out clients in the same 12/24h tick, so an unauthenticated visitor POSTs action=umcloudflare_clear with no nonce, copies return.nonce, and POSTs again with type=all. That calls purgeAll('/') → _purge() which sends the site's stored Cloudflare Bearer token to POST /zones/{zone}/purge_cache with prefixes for the whole host. type=page and type=section take $_POST['url'] and purge that path or first-segment prefix (host forced to get_site_url() in _cleanupURL). The admin bar and umCFNonce localization are limited to administrator|editor, which is the intended policy (changelog 1.0.9 allowed editors to purge-all), but the AJAX action does not enforce it: Subscriber, Customer, and uid 0 all succeed once the plugin is configured (apikey+zone). On Pantheon, integrations/pantheon/pantheon.php registers a second wp_ajax_umcloudflare_clear callback that is also nonce-only and will pantheon_clear_edge_paths / _purgeKeys for any logged-in role. type=network is the one branch that fails closed (purgeNetwork requires is_super_admin). Observable on a configured site: two unauthenticated POSTs to admin-ajax.php empty the Cloudflare zone; origin uncached-traffic and the Cloudflare audit log for that API token confirm it. This is missing authorization plus a nonce oracle, not CSRF: no victim browser is required.

    umich-cloudflare.php:202-203, 1013-1071

    Recommendation

    Remove wp_ajax_nopriv_umcloudflare_clear. In ajaxOnPurge (and the Pantheon wp_ajax_umcloudflare_clear closure) require current_user_can('editor') || current_user_can('administrator') (or a dedicated cap) before purging, call check_ajax_referer without die=false so failures 403, and do not put a fresh nonce in the failure JSON. Keep type=network behind is_super_admin.

  • medium Web-accessible wp-cli passthru script purges Cloudflare with no authentication

    unnecessary_attack_surface

    scripts/wpcli-purgeall.php is documented as the Pantheon clear_cache webphp workflow (integrations/pantheon/_pantheon.yml points at wp-content/plugins/umich-cloudflare/scripts/wpcli-purgeall.php). The file has no ABSPATH / php_sapi_name / CLI guard: any HTTP client who can execute plugin PHP hits passthru("wp eval 'UMCloudflare::purgeAll(\"/\");' 2>&1") and the CLI stdout/stderr is written to the response. On hosts where the web PHP user has `wp` on PATH (Pantheon, some managed WP stacks) this is an unauthenticated full-zone purge that bypasses the AJAX nonce entirely. On hosts without wp-cli the same request still invokes passthru and reflects the shell error (path/environment disclosure). The command string is fixed, so this is not arbitrary RCE, but it is an unauthenticated state-changing endpoint at a predictable plugin path.

    scripts/wpcli-purgeall.php:1-3

    Recommendation

    Refuse non-CLI execution (php_sapi_name() === 'cli' or defined('WP_CLI')) and do not echo passthru to the HTTP client. Prefer invoking UMCloudflare::purgeAll('/') in-process from a WP-CLI command rather than shelling out. If the Pantheon workflow must stay webphp, gate it with a Pantheon-only secret or move the script outside the web root.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.