CVE-2014-9414: boldgrid w3_total_cache Cross-Site Request Forgery (CSRF)
Vulnerability summary
CVE-2014-9414 is a medium (CVSS 6.8) Cross-Site Request Forgery (CSRF) vulnerability in boldgrid w3_total_cache. EPSS estimates a 1.36% chance of exploitation in the next 30 days, higher than 71.2% of scored vulnerabilities. 3 public exploits are recorded.
Timeline
- 24-12-2014PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The W3 Total Cache plugin before 0.9.4.1 for WordPress does not properly handle empty nonces, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and hijack the authentication of administrators for requests that change the mobile site redirect URI via the mobile_groups[*][redirect] parameter and an empty _wpnonce parameter in the w3tc_mobile page to wp-admin/admin.php.
CVSS metrics
2 scores · 2 sources · 2 versionsEPSS trend
Probability
1.36%
Chance of exploitation in the next 30 days
Percentile
71%
Versus all other CVEs
30-day change
0.00 pp
From 1.36% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (mazinahmed1.blogspot.com)
Maturity: unknown
Exploit Reference (seclists.org)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Boldgrid1 product
- w3_total_cache≤ 0.9.4
Wordpress1 product
- w3-total-cache≤ 0.9.4 (fixed in 0.9.4.1)
2 vendors · 2 products
References
9 links- packetstormsecurity.com/files/129512/W3-Total-Cache-0.9.4-Cross-Site-Request-Forgery.htmlX Refsource MISCExploit