AIKIDO-2025-10824
W3 Total Cache is vulnerable to Command Injection
90
Critical Risk
This Affects:
W3 Total CacheTL;DR
Affected versions of the W3 Total Cache plugin are vulnerable to command injection in the _parse_dynamic_mfunc function, allowing unauthenticated users to execute arbitrary PHP code by submitting a comment containing a crafted malicious payload on a post.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
W3 Total Cache is vulnerable to Command Injection in versions 0.0.1 - 2.8.12.
How to fix this
Upgrade the W3 Total Cache library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant