What is the CVSS score of CVE-2026-5032?

CVE-2026-5032 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-5032?

W3 Total Cache plugin versions up to 2.9.3 expose security tokens to unauthenticated attackers through a User-Agent header bypass, allowing remote extraction of authentication credentials embedded in…

How to fix or mitigate CVE-2026-5032?

Within 24 hours: Inventory all WordPress installations using W3 Total Cache and identify current plugin versions. Within 7 days: Upgrade W3 Total Cache to version 2.9.4 or later on all affected instances; verify upgrade completion and clear all cache. Within 30 days: Conduct security audit of any security tokens that may have been exposed during the vulnerable period and rotate them if compromise is suspected.

WordPress CVE-2026-5032

EUVD-2026-18136 HIGH

Information Exposure (CWE-200)

2026-04-02 Wordfence

WordPress Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

EUVD ID Assigned

Apr 02, 2026 - 07:45 euvd

EUVD-2026-18136

Analysis Generated

Apr 02, 2026 - 07:45 vuln.today

CVE Published

Apr 02, 2026 - 07:39 nvd

HIGH 7.5

DescriptionCVE.org

The W3 Total Cache plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 2.9.3. This is due to the plugin bypassing its entire output buffering and processing pipeline when the request's User-Agent header contains "W3 Total Cache", which causes raw mfunc/mclude dynamic fragment HTML comments - including the W3TC_DYNAMIC_SECURITY security token - to be rendered in the page source. This makes it possible for unauthenticated attackers to discover the value of the W3TC_DYNAMIC_SECURITY constant by sending a crafted User-Agent header to any page that contains developer-placed dynamic fragment tags, granted the site has the fragment caching feature enabled.

AnalysisAI

W3 Total Cache plugin for WordPress exposes security tokens to unauthenticated remote attackers through User-Agent header manipulation. Versions up to 2.9.3 bypass output buffering when requests contain 'W3 Total Cache' in the User-Agent, leaking W3TC_DYNAMIC_SECURITY tokens embedded in dynamic fragment HTML comments. With CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) indicating trivial exploitation requiring no authentication, attackers can extract these tokens from any page using fragment caching, enabling potential security bypass or escalation attacks. Patch available in version 2.9.4+ per upstream changeset.

Technical ContextAI

W3 Total Cache is a WordPress performance optimization plugin (CPE: cpe:2.3:a:boldgrid:w3_total_cache) that implements fragment caching through mfunc/mclude dynamic tags and protects these fragments with a W3TC_DYNAMIC_SECURITY constant. The vulnerability (CWE-200: Information Exposure) occurs in the Generic_Plugin.php output buffering logic where the plugin prematurely terminates processing when detecting its own User-Agent string. This implementation flaw causes raw HTML comments containing security tokens to reach the browser unprocessed. The fragment caching feature uses these tokens as authentication mechanisms for rendering dynamic content within cached pages, making token exposure a critical security control failure that undermines the entire dynamic fragment security model.

RemediationAI

Upgrade W3 Total Cache plugin to version 2.9.4 or later, which addresses the User-Agent bypass vulnerability per the upstream changeset at https://plugins.trac.wordpress.org/changeset/3495959/w3-total-cache. WordPress administrators should access the Plugins dashboard and update through the standard update mechanism. As an interim mitigation for sites unable to immediately patch, disable fragment caching functionality through W3 Total Cache settings (Performance > Fragment Cache) to eliminate token exposure risk, though this reduces caching effectiveness. Web application firewalls can be configured to block requests containing 'W3 Total Cache' in User-Agent headers from non-administrative IP ranges. Comprehensive vulnerability details and affected code analysis available at https://www.wordfence.com/threat-intel/vulnerabilities/id/a65eb62d-847b-4f3a-848b-1290e3118c01?source=cve. Post-patching, consider rotating or regenerating W3TC_DYNAMIC_SECURITY constants if prior exposure is suspected.