W3 Total Cache EUVD-2026-18136

Requires W3 Total Cache plugin for WordPress versions up to 2.9.3 installed and enabled. Attacker sends HTTP request with User-Agent header containing 'W3 Total Cache' to any page. No authentication or victim interaction required. Remote unauthenticated exploitation.

Real-world risk is elevated despite the information disclosure classification. The CVSS 7.5 score reflects trivial exploitation (AC:L, PR:N) with high confidentiality impact, and the attack vector is completely remote with no user interaction required. While no public exploit code is confirmed and CISA KEV status is not indicated in available data, the technical simplicity (sending a single HTTP header) combined with widespread W3 Total Cache deployment creates significant exposure. The disclosed W3TC_DYNAMIC_SECURITY token can potentially enable secondary attacks including cache poisoning, authentication bypass, or privilege escalation in fragment rendering logic. SSVC assessment suggests elevated priority: exploitation is trivial and automatable, technical impact allows security control bypass, and the vulnerability affects a popular WordPress plugin with millions of installations. The clear remediation path (patch available) slightly reduces urgency, but the low exploitation complexity and potential for automated scanning makes this a genuine priority for WordPress administrators running fragment caching configurations.

An unauthenticated attacker identifies a WordPress site running W3 Total Cache with fragment caching enabled. The attacker sends HTTP requests to public pages with a modified User-Agent header containing the string 'W3 Total Cache', causing the plugin to bypass output processing and return unprocessed HTML source. By examining the response, the attacker extracts W3TC_DYNAMIC_SECURITY tokens from mfunc/mclude HTML comments that would normally be stripped during rendering. With the security token in hand, the attacker can craft malicious requests to fragment rendering endpoints, potentially bypassing authentication checks, injecting cached content, or triggering server-side code execution through fragment processing vulnerabilities. The attack requires only basic HTTP tools and succeeds against default configurations without any user interaction or elevated privileges.