Unknown W3 Total Cache vulnerabilities
3 vulnerabilities
Known vulnerabilities in Unknown W3 Total Cache, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2025-9501unknownw3 total cache+1
EPSS score22.11%
The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the _parse_dynamic_mfunc function, allowing unauthenticated users to execute PHP commands by submitting a comment with a malicious payload to a post.CVE-2026-18051unknownw3 total cache+1EPSS score0.57%
The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target name.
On Apache, the same flaw overwrites the site's .htaccess files, which breaks the site and can strip hardening rules that other security measures rely on.CVE-2026-107321unknownw3 total cache+1EPSS score0.24%
The W3 Total Cache WordPress plugin before 2.10.6 does not confine a media-import file copy to the document root, nor enforce an effective file-type restriction on it, allowing users with the Author role or higher to plant content that, once an administrator runs the import, copies an arbitrary server-readable file into a publicly served directory, exposing it to unauthenticated retrieval.