W3 Total Cache CVE-2026-39595

The attacker must hold a valid WordPress account with the Author role (or higher) on the target site. Author-level access is the minimum required privilege, as the broken access control specifically concerns operations that should be restricted above the Author capability boundary. Sites that do not grant Author accounts to untrusted or external users are not realistically exploitable via this path alone. No special plugin configuration mode or non-default setting is described as a prerequisite - the vulnerability appears to be present in the default plugin installation for all affected versions. Exploitation is limited by: the requirement for a valid Author-level (or higher) authenticated session, the unchanged scope (no lateral movement to other WordPress components or the underlying OS), and the low individual CIA impact ceiling. Unauthenticated exploitation is not supported by the CVSS vector (PR:H).

The CVSS base score of 4.7 (Medium) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L reflects a genuinely constrained risk profile: exploitation requires the attacker to already hold an Author account on the target WordPress site, which is not a trivially obtained precondition in most site configurations. No EPSS score was provided in the source data, so exploitation probability cannot be quantified from that signal. No KEV listing exists, and no POC has been identified. Real-world risk is therefore limited to sites that grant Author accounts to semi-trusted or external contributors - a common pattern for editorial workflows, multi-author blogs, and community sites. For single-author or tightly controlled WordPress installs, exploitability is near zero without a separate account-takeover or registration pathway. The impact being limited to low C/I/A and unchanged scope (S:U) means even a successful exploit yields partial cache data exposure, limited settings tampering, or cache disruption - not remote code execution or full site compromise. This is a real but non-critical finding; sites with Author-role contributors should prioritize patching, while tightly locked-down sites are at substantially reduced risk.

An attacker who holds a legitimate WordPress Author account - obtained via registration, social engineering, or credential compromise - sends a crafted HTTP request directly to the W3 Total Cache plugin's unprotected endpoint, bypassing the missing capability check. Because no additional user interaction is required and the attack complexity is low, the attacker can read limited cache configuration data, modify caching settings, or flush caches to degrade site performance. No public POC has been identified, but the low complexity rating suggests the endpoint interaction is straightforward once the vulnerable action name is known.