Unauthorized Data Access in W3 Total Cache Plugin for WordPress

CVE-2024-12365

Summary

The W3 Total Cache plugin is susceptible to unauthorized access to sensitive data due to an absence of capability checks on the is_w3tc_admin_page function. This flaw affects all versions up to and including 2.8.1, enabling authenticated attackers with Subscriber-level access and above to exploit the vulnerability. Attackers can retrieve the plugin's nonce value, perform unauthorized operations, disclose information, exhaust service plan limits, and facilitate web requests to any location. This presents risks for querying data from internal services, including crucial instance metadata in cloud-based environments.

References