CVE-2023-5359: boldgrid w3_total_cache
Vulnerability summary
CVE-2023-5359 is a high (CVSS 7.5) vulnerability in boldgrid w3_total_cache. EPSS estimates a 0.81% chance of exploitation in the next 30 days, higher than 56.5% of scored vulnerabilities.
Timeline
- 24-09-2024PublishedVulnerability first disclosed.
- 08-04-2026Last modifiedVulnerability information updated.
Description
The W3 Total Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.5 via Google OAuth API secrets stored in plaintext in the publicly visible plugin source. This can allow unauthenticated attackers to impersonate W3 Total Cache and gain access to user account information in successful conditions. This would not impact the WordPress users site in any way.
CVSS metrics
3 scores · 3 sources · 1 version- CVE.orgCNA3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NDiffers
- wordfenceSource3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NDiffers
EPSS trend
Probability
0.81%
Chance of exploitation in the next 30 days
Percentile
57%
Versus all other CVEs
30-day change
0.00 pp
From 0.81% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-312Cleartext Storage of Sensitive InformationThe product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Affected systems
Boldgrid1 product
- w3_total_cache≤ 2.7.5 | < 2.7.6
Wordpress1 product
- w3-total-cache≤ 2.7.5 (fixed in 2.7.6)
2 vendors · 2 products