W3 Total Cache Plugin Vulnerability Exposes Over One Million WordPress Sites

W3 Total Cache Plugin Vulnerability Exposes Over One Million WordPress Sites

First seen 2 Dec 2025, 18:33 UTC •ThecyberexpressBleepingcomputerWebpronews •90% similarity •50.3

Article Content

Browse articles
ThreatCluster

A critical vulnerability, tracked as CVE-2025-9501, has been identified in the W3 Total Cache WordPress plugin, affecting all versions prior to 2.8.13. This flaw allows unauthenticated attackers to execute arbitrary PHP commands, potentially leading to full site takeovers for over one million installations. The developer has released a patch to address this security issue.

ThreatCluster AI How this analysis works

Extracted Entities

1 / 2

Community

Browse all →

Tracked Entities in This Story

Elementor Elementor Pro GutenKit Hunk Companion PHP Really Simple Security