Loading story…
A critical vulnerability (CVE-2025-9501) has been identified in the W3 Total Cache WordPress plugin, affecting versions prior to 2.8.13. This flaw allows unauthenticated attackers to execute arbitrary PHP commands on affected sites by submitting a specially crafted comment, exploiting the _parse_dynamic_mfunc function. The vulnerability has been assigned a CVSS score of 9.0, indicating a high risk of remote code execution, and potentially impacts up to 1 million WordPress sites using the vulnerable plugin version.
Security researchers warn that exploitation of this vulnerability could allow attackers to fully compromise WordPress installations without authentication, leading to site defacement, data theft, or further malware deployment. Administrators are strongly advised to update W3 Total Cache to version 2.8.13 or later to mitigate the risk, as the vulnerability is remotely exploitable and poses a significant threat to a large number of websites.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Researchers disclosed that the bug stems from eval() use in the _parse_dynamic_mfunc function and can be exploited through crafted comments when the W3TC_DYNAMIC_SECURITY secret is known, comments are enabled, and Page Cache is active. A working pre-auth RCE exploit was confirmed and published, providing concrete technical details about exploitability.
Public reporting identified CVE-2025-9501 as a critical vulnerability in W3 Total Cache versions before 2.8.13, affecting a plugin with more than 1 million WordPress installations. The flaw was described as an unauthenticated command injection with a CVSS score of 9.0.
The unauthenticated command injection flaw later assigned CVE-2025-9501 was originally reported by researcher wcraft to WPScan. The issue affected W3 Total Cache and could lead to remote code execution under certain plugin configurations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcercesecurity.com
Open sourcesecurityonline.info
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability in the WordPress **W3 Total Cache** plugin allows remote, unauthenticated attackers to execute arbitrary PHP commands on affected sites. Tracked as **`CVE-2025-9501`**, the flaw affects versions earlier than **`2.8.13`** and is tied to insufficient validation of user input in the plugin’s **`_parse_dynamic_mfunc()`** function. According to CSIRT.SK, the bug can be triggered through a specially crafted comment, creating a path to full system compromise on vulnerable WordPress installations. The issue carries a **CVSS v3 score of 9.0**, underscoring the risk to organizations running the plugin in production. Security updates were released by the vendor in **W3 Total Cache 2.8.13**, and defenders are being urged to upgrade immediately and review WordPress databases, site files, and logs for evidence of exploitation or malicious post-compromise activity.
Jul 24, 2026
A **critical vulnerability in the WordPress plugin *WPvivid Backup & Migration*** (aka *Migration, Backup, Staging – WPvivid Backup & Migration*) allows **unauthenticated arbitrary file upload leading to remote code execution (RCE)** on affected sites. Tracked as **CVE-2026-1357** with **CVSS 9.8**, the issue impacts plugin versions **<= 0.9.123** and is tied to the plugin’s remote transfer functionality (`send_to_site()` / `wpvivid_action=send_to_site`), which processes incoming backup data from other sites. Technical details indicate the exploit chain combines **broken cryptographic error handling** with **unsafe file write behavior**: when `openssl_private_decrypt()` fails, execution continues and a `false` value is passed into AES initialization, which is treated as a predictable **null-byte key**. Attackers can craft payloads encrypted with this null-byte key to bypass intended protections, then leverage missing file validation (and reported lack of filename/path sanitization enabling **directory traversal**) to write attacker-controlled files (e.g., PHP web shells) into web-accessible locations, enabling full site takeover and data access (including database contents).
Jun 29, 2026
A critical unauthenticated remote code execution vulnerability has been identified in the *Advanced Custom Fields: Extended* plugin for WordPress, affecting versions 0.9.0.5 through 0.9.1.1. The flaw resides in the `prepare_form()` function, which improperly handles user input by passing it directly to `call_user_func_array()`, enabling attackers to execute arbitrary code on the server without authentication. This vulnerability allows threat actors to inject backdoors, create new administrative accounts, and potentially take full control of affected WordPress sites. Security researchers warn that exploitation of this vulnerability could lead to complete compromise of website integrity and confidentiality, including data theft and malware installation. Administrators are strongly advised to update the plugin to a secure version, implement Zero Trust security models, enable multi-factor authentication for admin accounts, and harden PHP configurations. The vulnerability is mapped to MITRE ATT&CK techniques T1059 (Command and Scripting Interpreter) and T1190 (Exploit Public-Facing Application).
Jun 29, 2026