# W3 Total Cache <= 2.10.7 - Unauthenticated Content Injection via Predictable HTML Minify Placeholders

- **ID:** WPSEC-2026-1409
- **Plugin:** W3 Total Cache (`w3-total-cache`), https://wordpress.org/plugins/w3-total-cache/
- **Affected versions:** all versions before 2.11.0
- **Fixed in:** 2.11.0 (Update to 2.11.0 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-330
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/w3-total-cache
- **Fix released:** 2026-10-20
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1409/

## Description

The W3 Total Cache plugin for WordPress is vulnerable to content injection in all versions up to, and including, 2.10.7 due to HTML and CSS minifier placeholder tokens being derived from md5 of the request time, which makes them predictable. This makes it possible for unauthenticated attackers to submit content, such as comments, containing a guessed placeholder that is substituted with reserved page blocks (for example scripts or styles) during minification, altering the structure of the generated page. Exploitation requires HTML minification to be enabled and the placeholder to be guessed correctly.

## References

- https://wpsec.com/vuln/WPSEC-2026-1409/
- https://plugins.svn.wordpress.org/w3-total-cache/tags/2.11.0/
- https://wordpress.org/plugins/w3-total-cache/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1409/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.