w3_total_cache 漏洞

高危CVE-2026-50322026/09/30

W3 Total Cache <= 2.9.3 - Unauthenticated Dynamic Security Token Disclosure

The W3 Total Cache WordPress plugin through version 2.9.3 skips its entire output buffering and processing pipeline whenever an incoming request's User-Agent header contains the string "W3 Total Cache", without authenticating the caller. On sites that use developer-placed dynamic fragment tags, the raw mfunc/mclude HTML comments - which embed the per-site W3TC_DYNAMIC_SECURITY token - are therefore rendered directly into the page source instead of being processed and stripped, letting an unauthenticated attacker harvest the token by comparing a normal response against one sent with the magic User-Agent.

w3_total_cachePoC 已收录

CVSS—

高危CVE-2026-92822026/07/28

W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read

W3 Total Cache WordPress plugin <= 2.9.4 contains a directory traversal caused by improper handling in setupSources function, letting unauthenticated attackers read arbitrary files, exploit requires manual minify mode enabled with specific filename.

w3_total_cachePoC 已收录

CVSS—

中危CVE-2024-120082026/06/25

W3 Total Cache < 2.8.2 - Log File Exposure

The plugin is vulnerable to Information Exposure through the publicly exposed debug log file. This makes it possible for unauthenticated attackers to view potentially sensitive information in the exposed log file. For example, the log file may contain nonce values that can be used in further CSRF attacks.

w3_total_cachePoC 已收录

CVSS—

低危2026/01/14

WordPress W3 Total Cache - Full Path Disclosure

WordPress W3 Total Cache plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly.

w3_total_cachePoC 已收录

CVSS—

中危2023/10/20

Wordpress W3C Total Cache <= 0.9.4 - Server Side Request Forgery (SSRF)

The W3 Total Cache WordPress plugin was affected by an Unauthenticated Server Side Request Forgery (SSRF) security vulnerability.

w3_total_cachePoC 已收录

CVSS—

中危CVE-2021-244522021/07/19

W3 Total Cache < 2.1.5 - Cross-Site Scripting

The W3 Total Cache WordPress plugin before 2.1.5 was affected by a reflected Cross-Site Scripting (XSS) issue within the "extension" parameter in the Extensions dashboard, when the 'Anonymously track usage to improve product quality' setting is enabled, as the parameter is output in a JavaScript context without proper escaping. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.

w3_total_cachePoC 已收录

CVSS6.1EPSS 9.6%

中危CVE-2021-244362021/07/19

W3 Total Cache < 2.1.3 - Reflected XSS in Extensions Page

The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" parameter in the Extensions dashboard, which is output in an attribute without being escaped first. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.

w3_total_cachePoC 已收录

CVSS6.1EPSS 5.8%

严重CVE-2013-20102020/02/12

CVE-2013-2010

WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability

w3_total_cacheRCE

CVSS9.8EPSS 82.2%

高危CVE-2019-67152019/04/01

W3 Total Cache 0.9.2.6-0.9.3 - Unauthenticated File Read / Directory Traversal

WordPress plugin W3 Total Cache before version 0.9.4 allows remote attackers to read arbitrary files via the SubscribeURL field in SubscriptionConfirmation JSON data via pub/sns.php.

w3_total_cachePoC 已收录

CVSS7.5EPSS 92.2%

w3_total_cache

关联漏洞