PT-2026-29688 · WordPress · W3 Total Cache

Wesley · Published 2026-04-02 · Updated 2026-04-05 · CVE-2026-5032

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions W3 Total Cache versions up to and including 2.9.3

Description The W3 Total Cache plugin for WordPress is susceptible to information disclosure. The plugin bypasses its output buffering and processing when the User-Agent header contains "W3 Total Cache", leading to the rendering of raw mfunc/mclude dynamic fragment HTML comments, including the W3TC DYNAMIC SECURITY security token, in the page source. This allows unauthenticated attackers to discover the value of the W3TC DYNAMIC SECURITY constant by sending a crafted User-Agent header to pages with enabled fragment caching.

Recommendations Update W3 Total Cache to a version later than 2.9.3.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-5032

Affected Products

W3 Total Cache

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-5032 · Security Note
• https://reddit.com/r/wpsafety/comments/1scywd0/weekly_cve_roundup_critical_rce_in_everest_forms · Reddit Post
• https://plugins.trac.wordpress.org/changeset/3495959/w3-total-cache · Note
• https://twitter.com/CVEnew/status/2039647704415125674 · Twitter Post
• https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.9.3/Generic_Plugin.php#L1016 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/a65eb62d-847b-4f3a-848b-1290e3118c01?source=cve · Note