{
 "id": "WPSEC-2026-1409",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1409/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1409/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1409/index.md",
 "title": "W3 Total Cache <= 2.10.7 - Unauthenticated Content Injection via Predictable HTML Minify Placeholders",
 "description": "The W3 Total Cache plugin for WordPress is vulnerable to content injection in all versions up to, and including, 2.10.7 due to HTML and CSS minifier placeholder tokens being derived from md5 of the request time, which makes them predictable. This makes it possible for unauthenticated attackers to submit content, such as comments, containing a guessed placeholder that is substituted with reserved page blocks (for example scripts or styles) during minification, altering the structure of the generated page. Exploitation requires HTML minification to be enabled and the placeholder to be guessed correctly.",
 "plugin": {
  "slug": "w3-total-cache",
  "name": "W3 Total Cache",
  "full_name": "W3 Total Cache",
  "wordpress_org": "https://wordpress.org/plugins/w3-total-cache/",
  "advisories_url": "https://wpsec.com/vuln/plugin/w3-total-cache/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/w3-total-cache"
 },
 "type": "CONTENT INJECTION",
 "cwe": [
  "CWE-330"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.11.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.11.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.11.0",
 "remediation": "Update to 2.11.0 or later.",
 "fix_released": "2026-10-20T20:36:47+00:00",
 "published": "2026-10-21T20:43:15+00:00",
 "updated": "2026-10-21T12:33:09.908762+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1409/",
  "https://plugins.svn.wordpress.org/w3-total-cache/tags/2.11.0/",
  "https://wordpress.org/plugins/w3-total-cache/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/w3-total-cache",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-21"
 }
}