Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

W3 Total Cache unauthenticated command injection (CVE-2025-9501)

Vulnerability
First reported
Last updated
Happening score
H score 14
1 unique sources, 1 articles

Summary

Hide ▲

A critical W3 Total Cache (W3TC) flaw lets attackers use unauthenticated command injection through a malicious comment payload, potentially giving them full control of affected WordPress servers. The issue is CVE-2025-9501 and affects all versions prior to 2.8.13. A fixed release, 2.8.13, is available.

Related Happenings

CISA KEV mitigation for LiteSpeed cPanel Plugin (CVE-2026-54420)

Advisory/Mitigation
H score38 First: 16.06.2026 08:41 Last: 16.06.2026 08:41 Sources 1

About this happening: CISA put CVE-2026-54420 in LiteSpeed cPanel Plugin on the KEV catalog, ordering FCEB agencies to apply fixes by June 18, 2026. The flaw is a CVSS 8.5 privile...

Open Happening

Gladinet CentreStack and Triofox workaround for CVE-2025-11371

Advisory/Mitigation
H score40 First: 10.10.2025 22:08 Last: 10.10.2025 22:08 Sources 1

About this happening: CentreStack and Triofox are affected by CVE-2025-11371, a local file inclusion zero-day that threat actors have abused since late September to read Web.confi...

Open Happening

CISA KEV addition for Smartbedded Meteobridge CVE-2025-4008

Public Sector Action
H score36 First: 03.10.2025 11:23 Last: 03.10.2025 11:23 Sources 1

About this happening: CISA added CVE-2025-4008 in Smartbedded Meteobridge to the KEV catalog, signaling active exploitation and requiring FCEB agencies to apply updates by October...

Open Happening

Timeline

  1. 19.11.2025 19:34 1 articles · 7mo ago

    W3 Total Cache 2.8.13 patch release

    Mitigation Patch Update

    W3 Total Cache released version 2.8.13 on October 20 to fix CVE-2025-9501, a critical unauthenticated command injection flaw in the WordPress plugin that affects all versions prior to 2.8.13.

    Show sources
    Open in new tab
  2. 19.11.2025 19:34 2 articles · 7mo ago

    CVE-2025-9501 disclosed in W3 Total Cache

    Initial Disclosure

    WPScan highlighted CVE-2025-9501 in the W3 Total Cache WordPress plugin on November 19, describing a comment-based malicious payload that can trigger _parse_dynamic_mfunc() to run PHP commands on the server without authentication; the flaw affects all versions prior to 2.8.13, WPScan said it would publish a proof-of-concept exploit on November 24, and site operators were advised to upgrade to 2.8.13 or deactivate the plugin until protected.

    Show sources
    Open in new tab