The W3 Total Cache plugin for WordPress contains a critical information exposure vulnerability that can be leveraged by unauthenticated attackers to achieve remote code execution.

The plugin fails to sanitize output when the User-Agent header is set to "W3 Total Cache," which exposes the W3TC_DYNAMIC_SECURITY token to unauthenticated users. This token can then be used to bypass security restrictions and execute arbitrary PHP code on the server.

This vulnerability carries a CVSS score of 7.5, indicating a high level of risk. Because it allows for remote code execution, an attacker could gain full control over the WordPress environment, leading to complete data compromise, unauthorized modification of site content, and potential lateral movement within the hosting infrastructure.

Immediate Action: Update the W3 Total Cache plugin to the latest version available from the WordPress repository, which contains the necessary security patches.

Proactive Monitoring: Review server access logs for requests containing the "W3 Total Cache" User-Agent string, particularly those originating from suspicious or unexpected IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or sanitize incoming HTTP requests that explicitly set the User-Agent to "W3 Total Cache" until the plugin can be updated.

Public Exploit Available: No (A Nuclei detection template exists, but no weaponized exploit or public proof-of-concept repository has been confirmed).

Given the potential for remote code execution, this vulnerability poses a significant threat to WordPress installations. Administrators should verify their current version of W3 Total Cache and apply the available update immediately. If patching is not immediately feasible, ensure that the fragment caching feature is disabled as a temporary security measure.