Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.0

W3 Total Cache Plugin on WordPress Can Run Malicious Code

CVE-2026-57623 · published 3 months ago
Summary

An outdated version of the W3 Total Cache plugin on WordPress websites can allow hackers to execute malicious code. This is a serious issue because it could lead to unauthorized access to sensitive data or even take control of the website. Update the plugin to the latest version to fix this vulnerability.

What to do
  • Update boldgrid w3 total cache to version 2.10.0.
Affected software
Ecosystem VendorProductAffected versions
wordpress boldgrid w3 total cache <= 2.9.4
Fix: upgrade to 2.10.0
Original advisory text
WordPress W3 Total Cache plugin <= 2.9.4 - Arbitrary Code Execution vulnerability
Unauthenticated Arbitrary Code Execution in W3 Total Cache <= 2.9.4 versions.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-1284Improper Validation of Specified Quantity in Input
Timeline
Published2 Jul 2026
Updated29 Sep 2026
First seen2 Jul 2026
Sources
CVE-2026-57623 · NVD
CVE-2026-57623 · PATCHSTACK
Track software like this
Free during beta