WP Manifestindependent plugin directory
manifest / performance / umich-varnish

University of Michigan: Varnish Cache WP RegistryHigh-severity findings · 1 findingOpen the reportC-

Wordpress Varnish Purge Manager

by U-M: OVPC Digital · github.com/umdigital/umich-varnish · website

★ 1stars
16release downloads
1.3.7latest · 2 years ago

Install

Download umich-varnish-1.3.7.zip From the 1.3.7 release on GitHub, Sep 25, 2024

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/umdigital/umich-varnish/releases/download/1.3.7/umich-varnish-1.3.7.zip
Updates itself. It ships its own updater (Update URI header), so new versions appear under Dashboard → Updates.
Readme github.com/umdigital/umich-varnish ↗

Varnish Cache Purge Manager

Provides easy and automatic ability to purge varnish cache for your whole site, section, or a page. Also adds metabox to override TTL and Disable cache for a specific page/post/cpt.

This requires that you have an existing Varnish setup with RegEx purge capabilities.

Releases

3 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.3.7 latest
Sep 25, 2024 2 years ago
umich-varnish-1.3.7.zip
8
1.3.6
Sep 23, 2024 2 years ago
umich-varnish-1.3.6.zip
2
1.3.5
Jun 12, 2024 2 years ago
umich-varnish-1.3.5.zip
6
C- grade

Security

University of Michigan: Varnish Cache 1.3.7 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.3.7
Findings
1
Worst severity
high
Content hash
cca327ff6aaaec5c5752530b…

Findings

  • high Unauthenticated cache purge via nopriv AJAX nonce leak

    missing_auth

    The action umvarnish_clear is registered for both authenticated and unauthenticated users. ajaxOnPurge only verifies a nonce and never calls current_user_can. Critically, every response sets return['nonce'] = wp_create_nonce('umich-varnish-nonce'), so an unauthenticated attacker who fails the first check still receives a valid uid-0 nonce and can immediately re-POST with type=all to purge the entire Varnish cache (DoS / cache poisoning facilitation).

    umich-varnish.php:88-89,328-378

    Recommendation

    Remove wp_ajax_nopriv_umvarnish_clear. Require current_user_can('edit_posts') or manage_options before purging. Do not return a fresh nonce to unauthenticated or unauthorized callers.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →