Broken Access Control in W3 Total Cache Plugin Affects WordPress
CVE-2026-39595

4.7MEDIUM

Key Information:

Vendor

WordPress
Status
W3 Total Cache
Vendor
CVE Published:
17 June 2026

What is CVE-2026-39595?

The W3 Total Cache plugin for WordPress exhibits a broken access control vulnerability in versions prior to 2.9.1. This flaw may allow unauthorized users to access restricted areas or functions, posing a significant risk to site security and data integrity. It is imperative for users of the affected plugin to update to the latest version to mitigate potential exploits associated with this vulnerability.

Affected Version(s)

W3 Total Cache <= 2.9.1

References

https://patchstack.com/database/wordpress/plugin/w3-total...
vdb-entry

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muhammad Sharief | Patchstack Bug Bounty Program
.