CVE-2025-9501 — W3 Total Cache < 2.8.13 - Unauthenticated Command Injection
The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the _parse_dynamic_mfunc function, allowing unauthenticated users to execute PHP command…
Published: 2025-11-17 · CVSS: 9.0 · CVSS 3.1
The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the _parse_dynamic_mfunc function, allowing unauthenticated users to execute PHP commands by submitting a comment with a malicious payload to a post.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7