Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

W3 Total Cache can leak security token

CVE-2026-5032 · published 7 months ago
Summary

All versions of the W3 Total Cache plugin for WordPress may expose a secret security token when a specially crafted browser identifier is sent. This token can let an attacker run any code on the server. Update the plugin to a newer version or remove the vulnerable feature until you can upgrade.

Original advisory text
The W3 Total Cache plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 2.9.3. This is due to the plugin bypassing its entire output buffering and proces...
The W3 Total Cache plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 2.9.3. This is due to the plugin bypassing its entire output buffering and processing pipeline when the request's User-Agent header contains "W3 Total Cache", which causes raw mfunc/mclude dynamic fragment HTML comments — including the W3TC_DYNAMIC_SECURITY security token — to be rendered in the page source. This makes it possible for unauthenticated attackers to discover the value of the W3TC_DYNAMIC_SECURITY constant by sending a crafted User-Agent header to any page that contains developer-placed dynamic fragment tags, granted the site has the fragment caching feature enabled. With the leaked W3TC_DYNAMIC_SECURITY token, an attacker can craft valid mfunc tags to execute arbitrary PHP code on the server, achieving remote code execution.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
3% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published2 Apr 2026
Updated3 Nov 2026
First seen2 Apr 2026
Sources
CVE-2026-5032 · NVD
Track software like this
Free during beta