What is the CVSS score of CVE-2026-57623?

CVE-2026-57623 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of W3 Total Cache are affected by CVE-2026-57623?

The W3 Total Cache WordPress caching plugin (versions ≤2.9.4) is vulnerable to unauthenticated remote code execution (CVSS 9.0) that allows attackers to fully compromise any affected WordPress site…

How to fix or mitigate CVE-2026-57623?

Within 24 hours: Conduct inventory of all WordPress installations to identify W3 Total Cache presence and version; immediately disable the plugin on any instance running version 2.9.4 or earlier. Within 7 days: Deploy Web Application Firewall rules to block exploitation attempts targeting the caching plugin; enable detailed audit logging on all WordPress environments; document all affected systems for tracking. Within 30 days: Monitor vendor advisory for patch release; deploy patch to staging environment immediately upon availability; complete production rollout of patched version across all systems; evaluate alternative caching solutions (Cloudflare, AWS CloudFront, Varnish) if patch timeline exceeds 60 days.

W3 Total Cache CVE-2026-57623

EUVD-2026-41365 CRITICAL

Improper Validation of Specified Quantity in Input (CWE-1284)

2026-07-02 Patchstack

GHSA-m2v8-v989-39q2

WordPress RCE W3 Total Cache Wordpress Plugin Boldgrid

9.0

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.0 CRITICAL

Unauthenticated network RCE (AV:N/PR:N/UI:N) with full impact and scope change; AC:H retained because a specific input-validation condition must be met.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:02 vuln.today

DescriptionCVE.org

Unauthenticated Arbitrary Code Execution in W3 Total Cache <= 2.9.4 versions.

AnalysisAI

Unauthenticated arbitrary code execution affects the W3 Total Cache WordPress caching plugin in all versions up to and including 2.9.4, allowing remote attackers to execute code and fully compromise the underlying site without credentials or user interaction. The scope-changing CVSS 9.0 (Critical) rating reflects the plugin's deep hooks into WordPress request handling. There is no public exploit identified at time of analysis and no CISA KEV listing, though the high exploitability of a widely deployed plugin makes it a strong patching priority.

Technical ContextAI

W3 Total Cache (vendor CPE cpe:2.3:a:boldgrid:w3_total_cache) is one of the most widely installed WordPress performance plugins, providing page, object, database, browser, and CDN caching by intercepting and rewriting request/response handling at the application layer. The root cause is classed as CWE-1284 (Improper Validation of Specified Quantity in Input), meaning a size, count, or index value supplied in input is not properly validated before use; when combined with the plugin's code-generation and caching internals this improper input validation escalates to arbitrary code execution. Because caching plugins operate early in and across the WordPress request lifecycle, a flaw here can affect the whole site rather than a single component, consistent with the CVSS scope-changed (S:C) designation.

RemediationAI

No vendor-released patch version was identified in the provided data; upgrade to the first W3 Total Cache release above 2.9.4 as published by the vendor once confirmed, and consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/w3-total-cache/vulnerability/wordpress-w3-total-cache-plugin-2-9-4-arbitrary-code-execution-vulnerability?_s_id=cve) for the exact fixed version before deploying. Until a confirmed patched version is available, the most effective compensating control is to deactivate and remove the W3 Total Cache plugin, which stops the vulnerable code path entirely at the cost of losing caching performance; where the plugin cannot be removed, place the WordPress site behind a WAF with virtual-patching rules for this vulnerability and restrict/monitor requests to the plugin's endpoints, accepting that WAF signatures may lag and can be bypassed. Because exploitation is unauthenticated and network-facing, also rotate secrets and review the site for signs of compromise if the plugin has been internet-exposed.