W3 Total Cache EUVD-2026-41365

Exploitation targets the W3 Total Cache plugin (versions <= 2.9.4) and requires no authentication (PR:N) and no user interaction (UI:N) over the network (AV:N), so any internet-reachable WordPress site with the vulnerable plugin active is exposed. The key limiting factor is the high attack complexity (AC:H): the attacker must satisfy a specific, hard-to-control condition tied to the improper input-quantity validation (CWE-1284) - such as precise input state or timing - rather than a single trivially repeatable request, which constrains reliable exploitation. Exploitation is further gated on the plugin being installed and active at version 2.9.4 or below; the exact code path and any feature/configuration requirement are not detailed in the available data and should be confirmed via the Patchstack advisory.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H yields a base score of 9.0 (Critical): network-reachable, no privileges, no user interaction, full confidentiality/integrity/availability impact, and a changed scope. The mitigating signal is AC:H - successful exploitation requires the attacker to win a specific, non-trivial condition (e.g., a race, precise timing, or a particular input state), which lowers the practical reliability of exploitation compared with an AC:L RCE. No EPSS score, no CISA KEV entry, and no POC were provided, so there is currently no evidence of active exploitation and no public exploit identified at time of analysis; the risk is driven by the plugin's very large install base rather than by confirmed in-the-wild activity. Net assessment: a genuine high priority given unauthenticated network RCE in ubiquitous software, but the attack-complexity qualifier means it may favor determined/targeted attackers over trivial mass exploitation until (and unless) a reliable exploit emerges. Data gap: no exact affected-version floor, patched version, or advisory detail beyond the Patchstack reference is available, so remediation specifics must be confirmed with the vendor.

A remote, unauthenticated attacker sends specially crafted requests to a WordPress site running W3 Total Cache 2.9.4 or earlier, supplying malformed quantity/size input that the plugin fails to validate, and triggers the specific condition needed to coerce the plugin into executing attacker-controlled code - giving full control of the site. No POC has been published, and the AC:H rating means the attacker must reliably hit the required precondition, so an automated exploit would likely need tuning against the target environment.