Unauthenticated Code Execution Vulnerability in W3 Total Cache by WordPress
CVE-2026-57623

9CRITICAL

Key Information:

Vendor

WordPress
Status
W3 Total Cache
Vendor
CVE Published:
2 July 2026

What is CVE-2026-57623?

A vulnerability exists in the W3 Total Cache plugin for WordPress, allowing unauthenticated users to execute arbitrary code. This flaw affects versions up to 2.9.4, presenting significant security risks to sites utilizing this plugin. It is crucial for site administrators to review their installations and apply any available security patches to mitigate potential exploitation.

Affected Version(s)

W3 Total Cache <= 2.9.4

References

https://patchstack.com/database/wordpress/plugin/w3-total...
vdb-entry

CVSS V3.1

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program
.