Vulnerabilities / W3 Total Cache / WPSEC-2026-1409
W3 Total Cache <= 2.10.7 - Unauthenticated Content Injection via Predictable HTML Minify Placeholders
Low 3.7
CWE-330Fixed in 2.11.0
- ID
- WPSEC-2026-1409
- Plugin
- W3 Total Cache (w3-total-cache)
- Affected
- all versions before 2.11.0
- Remediation
- Update to 2.11.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-330
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-21
- Attack surface
- W3 Total Cache on WPSec AttackSurface
- Fix released
- Published
Description
The W3 Total Cache plugin for WordPress is vulnerable to content injection in all versions up to, and including, 2.10.7 due to HTML and CSS minifier placeholder tokens being derived from md5 of the request time, which makes them predictable. This makes it possible for unauthenticated attackers to submit content, such as comments, containing a guessed placeholder that is substituted with reserved page blocks (for example scripts or styles) during minification, altering the structure of the generated page. Exploitation requires HTML minification to be enabled and the placeholder to be guessed correctly.
References
- https://wpsec.com/vuln/WPSEC-2026-1409/
- https://plugins.svn.wordpress.org/w3-total-cache/tags/2.11.0/
- https://wordpress.org/plugins/w3-total-cache/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS