CVE-2026-5032

The W3 Total Cache plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 2.9.3. This is due to the plugin bypassing its entire output buffering and processing pipeline when the request's User-Agent header contains "W3 Total Cache", which causes raw mfunc/mclude dynamic fragment HTML comments — including the W3TC_DYNAMIC_SECURITY security token — to be rendered in the page source. This makes it possible for unauthenticated attackers to discover the value of the W3TC_DYNAMIC_SECURITY constant by sending a crafted User-Agent header to any page that contains developer-placed dynamic fragment tags, granted the site has the fragment caching feature enabled. With the leaked W3TC_DYNAMIC_SECURITY token, an attacker can craft valid mfunc tags to execute arbitrary PHP code on the server, achieving remote code execution.

• CWE-200

• https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.9.3/Generic_Plugin.php#L1016
• https://plugins.trac.wordpress.org/changeset/3495959/w3-total-cache
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a65eb62d-847b-4f3a-848b-1290e3118c01?source=cve

Published

Apr 2, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50313Heap-based buffer overflow in Windows NTFS allows an unautho…7.8
• CVE-2026-50314Use after free in Microsoft Office allows an unauthorized at…7.8
• CVE-2026-50315Null pointer dereference in Windows Image Acquisition allows…7.8
• CVE-2026-50316Insertion of sensitive information into log file in Windows …5.5
• CVE-2026-50317Concurrent execution using shared resource with improper syn…7
• CVE-2026-50318Stack-based buffer overflow in Windows Resilient File System…7.8
• CVE-2026-50321Concurrent execution using shared resource with improper syn…7
• CVE-2026-50322Concurrent execution using shared resource with improper syn…7
• CVE-2026-50323Use after free in Windows Runtime allows an authorized attac…7
• CVE-2026-50324Loop with unreachable exit condition ('infinite loop') in Ac…5.9
• CVE-2026-50325Improper access control in Windows Win32K allows an authoriz…7
• CVE-2026-50326Use after free in Windows Unified Consent System allows an a…7.8