9.0 Critical
CVE-2025-9501
W3 Total Cache < 2.8.13 - Unauthenticated Command Injection
Vendor not yet named
Status
- Not in CISA KEV
- Fixed in version 2.8.13
Exploit probabilityEPSSchecked 25 Oct
22%probability of exploitation in the next 30 days
Higher than 98% of scored CVEs
SeverityCVSS
9.0Critical
Description NVD
The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the _parse_dynamic_mfunc function, allowing unauthenticated users to execute PHP commands by submitting a comment with a malicious payload to a post.
Coverage 1 article · 1 outlet
- PCPJack worm spreads across cloud, stealing credentials via CVEsThe Hacker News · first in our coverage · mentions it in passing