Loading vulnerability…
CVE-2025-9501 is an unauthenticated command injection vulnerability in the W3 Total Cache WordPress plugin affecting versions prior to 2.8.13. The flaw is caused by unsafe use of eval() in the _parse_dynamic_mfunc function of the PgCache_ContentGrabber class while processing dynamic cache directives embedded in cached page content. An attacker who knows the W3TC_DYNAMIC_SECURITY secret can submit a crafted comment to a post and cause arbitrary PHP code to be evaluated when the cached page is parsed. The vulnerable path is associated with dynamic mfunc handling in page cache processing and can be reached through specially crafted comment content under specific plugin and site configurations. Because the injected payload is executed as PHP within the WordPress application context, successful exploitation results in remote code execution on the server.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone Python proof-of-concept exploit for CVE-2025-9501, described in the code as a pre-authenticated remote code execution issue in the W3 Total Cache WordPress plugin. The repository contains only two files: a minimal README and the main exploit script, poc_cve_2025_9501.py. The Python script is the clear entry point and implements the full exploitation workflow. The exploit logic is structured around several stages. First, it verifies or assumes the target is a WordPress site using W3 Total Cache. It then discovers candidate posts that allow unauthenticated comments, primarily through the WordPress REST API endpoint /wp-json/wp/v2/posts and secondarily by scraping the homepage and individual article pages for post IDs and comment form markers. Once a suitable post is found, it submits a malicious comment to /wp-comments-post.php. The comment body contains a W3 Total Cache mfunc block wrapping PHP code, with the default payload echo passthru($_GET['cmd']);. This means arbitrary OS commands can be supplied later through the cmd query parameter. After comment injection, the script triggers execution by requesting the target post URL in the form /?p={post_id}&cmd={cmd}. If the vulnerable caching behavior processes the injected mfunc block, the supplied command executes on the server and its output is returned in the HTTP response. The script supports using a provided secret, attempting to brute-force common secrets, and optionally trying to extract the secret from wp-config.php exposure. Based on the visible code and CLI options, this is an actual exploit rather than a detector. It is operational but not heavily weaponized: it includes a working hardcoded PHP command-execution payload and some automation for discovery and secret handling, but it is still a simple standalone PoC rather than a framework-integrated exploit.
41 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote code execution vulnerability in W3 Total Cache used by the PCPJack worm for initial access.
A remote code execution vulnerability in W3 Total Cache used by the PCPJack worm for initial access.
A PHP injection vulnerability in W3 Total Cache via cached mfunc comment, listed as one of the flaws leveraged by PCPJack for intrusion.
A specific known vulnerability that PCPJack reportedly exploits for propagation to additional hosts.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.