WordPress Plugin Vulnerabilities

W3 Total Cache < 2.10.0 - Unauthenticated Arbitrary Code Execution

Description

The plugin is vulnerable to Remote Code Execution. This makes it possible for unauthenticated attackers to execute arbitrary code on the server.

Affects Plugins

Plugin icon
w3-total-cache
Fixed in 2.10.0

References

CVE
CVE-2026-57623
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/b360f121-449f-43a8-b5e4-1cffddbaac77

Classification

Type
RCE
OWASP top 10
A1: Injection
CWE
CWE-94
CVSS
8.1 (high)

Miscellaneous

Original Researcher
Ananda Dhakal
Verified
Yes
WPVDB ID
cc8d57c6-3faa-4dd3-bc56-f3beb80c4f37

Timeline

Publicly Published
2026-06-29 (about 1 month ago)
Added
2026-07-09 (about 1 month ago)
Last Updated
2026-07-09 (about 1 month ago)

Other

Published
Title
Published
2025-09-22
Title
Cozy Blocks < 2.1.30 - Unauthenticated Arbitrary Shortcode Execution
Published
2025-03-26
Title
PDF for WPForms < 5.3.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution
Published
2023-08-28
Title
Import XML and RSS Feeds < 2.1.4 - Admin+ Arbitrary File Upload
Published
2023-12-06
Title
Elementor < 3.18.2 - Contributor+ Arbitrary File Upload to RCE via Template Import
Published
2026-02-10
Title
Custom Block Builder – Lazy Blocks < 4.2.1 - Contributor+ Remote Code Execution