PT-2025-47123 · WordPress · W3 Total Cache
Wcraft
·
Publicado
2025-10-27
·
Atualizado
2026-05-08
·
CVE-2025-9501
CVSS v3.1
9.0
Crítica
| Vetor | AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
W3 Total Cache versions prior to 2.8.13
Description
The W3 Total Cache WordPress plugin is affected by a command injection issue through the
parse dynamic mfunc function. This allows unauthenticated users to execute arbitrary PHP commands by submitting a comment containing a malicious payload to a post. It is estimated that over one million WordPress sites are potentially impacted. Exploitation involves submitting a crafted comment, which allows attackers to inject and execute PHP code, potentially leading to full site takeover. The parse dynamic mfunc function is responsible for processing calls to dynamic functions embedded in cached content. The vulnerability allows attackers to bypass authentication and execute commands on the server. A proof-of-concept exploit has been published.Recommendations
Update to W3 Total Cache version 2.8.13 or later.
Exploit
Correção
OS Command Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
W3 Total Cache