W3 Total Cache CVE-2026-111254

Exploitation is tightly gated and NOT a default-configuration scenario despite PR:N in the input vector. All of the following must hold simultaneously: (1) a W3TC Pro license was previously active with REST caching enabled; (2) that Pro license has since become inactive; (3) Disk Enhanced page caching remains configured after the license lapse, so a retained REST cache mode persists in an unlicensed state; and (4) the attacker already holds a previously approved commenter identity on the target site. The limiting factors are therefore substantial: the site must have transitioned from Pro to non-Pro with REST caching left retained, Disk Enhanced caching must be in use, and the attacker needs an existing approved-commenter foothold - a victim must also later load the cached injected page for the stored script to fire. Sites that never ran Pro REST caching, or that are still licensed, are not affected.

The input signals point in conflicting directions and, on balance, this is a high-CVSS-but-low-real-risk issue for most deployments. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N = 7.2) reads as a trivially reachable, unauthenticated, network stored XSS with scope change, which would normally be a priority. However, the description imposes an unusually narrow chain of prerequisites that the AC:L rating does not reflect: a W3TC Pro license must have previously been active with REST caching enabled, that license must since have become inactive, Disk Enhanced page caching must remain configured, and the attacker must already hold a previously approved commenter identity. That compound, non-default, state-dependent precondition is the opposite of AC:L, so the input CVSS almost certainly overstates ease of exploitation - verify against the Wordfence advisory. No CISA KEV listing is present, no EPSS probability was supplied, and no proof-of-concept or exploit reference was provided (the references are the Wordfence advisory, WordPress trac source lines, and the fix commit, not working exploit code). The vuln.today decision label is this_week rather than act_now or emergency, consistent with a real but non-urgent, condition-gated flaw. Net: patch on a normal this-week cadence; the raw 7.2 overstates practical exposure because the required configuration/identity preconditions sharply limit who can actually trigger it.

On a site that formerly ran W3TC Pro with REST caching but has lapsed to the free tier while Disk Enhanced page caching stays enabled, an attacker who already owns a previously approved commenter account submits a comment whose 'comment' value carries a script payload. Because the stale REST/Disk Enhanced caching path stores the response without sufficient sanitization or output escaping, the payload is written into a cached page and later executes in the browser of any user who visits that page. No public exploit code was identified in the provided data; the trigger mechanics are described only at the level of the affected caching configuration.