critical9.0
CVE-2025-9501
The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the _parse_dynamic_mfunc function, allowing unauthenticated users to e…
Impact
The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the _parse_dynamic_mfunc function, allowing unauthenticated users to execute PHP commands by submitting a comment with a malicious payload to a post.
Affected products
| Product | Affected versions |
|---|---|
| W3 Total Cache WordPress Plugin | before 2.8.13 |
Versions were read from the advisory text. No structured product data has been published for this record yet.