Vulnerability · Published Nov 17, 2025 · Assigned by WPScan
CVE-2025-9501W3 Total Cache < 2.8.13 - Unauthenticated Command Injection
Critical 9.0
In plain English
A critical-severity security flaw in W3 Total Cache from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 22.1% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)9.0Critical
Exploit odds (30 days)22.1%top 2.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the _parse_dynamic_mfunc function, allowing unauthenticated users to execute PHP commands by submitting a comment with a malicious payload to a post.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | W3 Total Cache | 0 – before 2.8.13 |
References
- https://wpscan.com/vulnerability/6697a2c9-63ae-42f0-8931-f2e5d67d45ae/ exploit, vdb-entry, technical-description