Critical W3 Total Cache Flaw (CVE-2025-9501, CVSS 9.0) Risks Unauthenticated RCE on 1 Million WordPress Sites

A newly disclosed high-severity flaw in the W3 Total Cache (W3TC) plugin puts more than 1 million WordPress sites at risk. Tracked as CVE-2025-9501, the vulnerability carries a CVSS score of 9.0 and enables unauthenticated command injection, potentially allowing full site takeover. Versions below 2.8.13 are affected due to improper handling within the plugin’s internal _parse_dynamic_mfunc function, enabling remote attackers to trigger arbitrary PHP execution by submitting a maliciously crafted comment.

The vulnerability is fully patched in version 2.8.13, and site owners are urged to update immediately. The researchers announced that the proof-of-concept will be displayed on 24 November 2025 to give users time to update, highlighting the risk of automated exploitation given the plugin’s widespread use. With more than a million active installs, even a small fraction of unpatched sites could create a large attack surface for unauthenticated exploitation.