CVE-2026-5032: falha de alta gravidade em boldgrid W3 Total Cache
W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
36Vexday Risk Score
Corrija em breve. Ela tem exploit funcional público.
ssvc Attendcvss 7.5epss 3.2%
The W3 Total Cache plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 2.9.3. This is due to the plugin bypassing its entire output buffering and processing pipeline when the request's User-Agent header contains "W3 Total Cache", which causes raw mfunc/mclude dynamic fragment HTML comments — including the W3TC_DYNAMIC_SECURITY security token — to be rendered in the page source. This makes it possible for unauthenticated attackers to discover the value of the W3TC_DYNAMIC_SECURITY constant by sending a crafted User-Agent header to any page that contains developer-placed dynamic fragment tags, granted the site has the fragment caching feature enabled. With the leaked W3TC_DYNAMIC_SECURITY token, an attacker can craft valid mfunc tags to execute arbitrary PHP code on the server, achieving remote code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
boldgrid · W3 Total CacheCVEs relacionadas — boldgrid W3 Total Cache
No mesmo produto, das mais perigosas para as menos.
CVE-2026-9282HIGHW3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' ParameterEPSS 2.9%CVE-2024-12008MEDIUMW3 Total Cache <= 2.8.1 Information Exposure via Log FilesEPSS 2.4%CVE-2024-12365HIGHW3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request ForgeryEPSS 1.8%CVE-2023-5359LOWW3 Total Cache <= 2.7.5 - Sensitive Credentials Stored in PlaintextEPSS 0.8%CVE-2024-12006MEDIUMW3 Total Cache <= 2.8.1 Missing Authorization to Unauthenticated Plugin Deactivation and Extensions Activation/DeactivationEPSS 0.5%CVE-2026-78438HIGHW3 Total Cache <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background MutatorEPSS 0.5%