+ 44 vulnerabilidades conocidas más
| CVE |
Vulnerabilidad |
Tipo |
Gravedad |
Afectadas |
Corregido en |
Publicado |
Estado |
|
CVE-2022-31090
|
W3 Total Cache [w3-total-cache] < 2.2.3 |
Exposición de información sensible a un actor no autorizado |
Alta
7,7
|
< 2.2.3
|
2.2.3 |
2022-06-20 |
✓ corregido en la última versión
|
|
CVE-2021-24452
|
W3 Total Cache [w3-total-cache] < 2.1.5 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,1
|
< 2.1.5
|
2.1.5 |
2021-06-28 |
✓ corregido en la última versión
|
|
CVE-2021-24436
|
W3 Total Cache [w3-total-cache] < 2.1.4 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,1
|
< 2.1.4
|
2.1.4 |
2021-06-28 |
✓ corregido en la última versión
|
|
CVE-2021-24427
|
W3 Total Cache [w3-total-cache] < 2.1.3 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
4,8
|
< 2.1.3
|
2.1.3 |
2021-04-25 |
✓ corregido en la última versión
|
|
CVE-2012-6078
|
W3 Total Cache [w3-total-cache] < 0.9.2.5 |
Exposición de información sensible a un actor no autorizado |
Alta
7,5
|
< 0.9.2.5
|
0.9.2.5 |
2019-11-22 |
✓ corregido en la última versión
|
|
CVE-2012-6077
|
W3 Total Cache [w3-total-cache] < 0.9.2.5 |
Exposición de información sensible a un actor no autorizado |
Alta
7,5
|
< 0.9.2.5
|
0.9.2.5 |
2019-11-22 |
✓ corregido en la última versión
|
|
CVE-2012-6079
|
W3 Total Cache [w3-total-cache] < 0.9.2.5 |
Exposición de información sensible a un actor no autorizado |
Alta
7,5
|
< 0.9.2.5
|
0.9.2.5 |
2019-11-22 |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 0.9.7.4 |
— |
Desconocido
|
< 0.9.7.4
|
0.9.7.4 |
2019-05-22 |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 0.9.7.4 |
— |
Desconocido
|
< 0.9.7.4
|
0.9.7.4 |
2019-05-07 |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 0.9.7.4 |
— |
Desconocido
|
< 0.9.7.4
|
0.9.7.4 |
2019-05-07 |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 0.9.7.4 |
— |
Desconocido
|
< 0.9.7.4
|
0.9.7.4 |
2019-05-07 |
✓ corregido en la última versión
|
|
CVE-2019-6715
|
W3 Total Cache [w3-total-cache] < 0.9.4 |
— |
Alta
7,5
|
< 0.9.4
|
0.9.4 |
2019-04-01 |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 0.9.5 |
— |
Desconocido
|
< 0.9.5
|
0.9.5 |
2016-11-10 |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 0.9.5 |
— |
Desconocido
|
< 0.9.5
|
0.9.5 |
2016-10-31 |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 0.9.5 |
— |
Desconocido
|
< 0.9.5
|
0.9.5 |
2016-09-27 |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 0.9.5 |
— |
Desconocido
|
< 0.9.5
|
0.9.5 |
2016-09-27 |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 0.9.5 |
— |
Desconocido
|
< 0.9.5
|
0.9.5 |
2016-09-27 |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 0.9.5 |
— |
Desconocido
|
< 0.9.5
|
0.9.5 |
2016-09-27 |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 0.9.5 |
— |
Desconocido
|
< 0.9.5
|
0.9.5 |
2016-09-26 |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 0.9.5 |
— |
Desconocido
|
< 0.9.5
|
0.9.5 |
2016-09-26 |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 0.9.5 |
— |
Desconocido
|
< 0.9.5
|
0.9.5 |
2016-09-26 |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 0.9.5 |
— |
Desconocido
|
< 0.9.5
|
0.9.5 |
2016-09-26 |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 0.9.5 |
— |
Desconocido
|
< 0.9.5
|
0.9.5 |
2016-09-26 |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 0.9.5 |
— |
Desconocido
|
< 0.9.5
|
0.9.5 |
2016-07-29 |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 0.9.4.1 |
— |
Desconocido
|
< 0.9.4.1
|
0.9.4.1 |
2015-05-15 |
✓ corregido en la última versión
|
|
CVE-2014-8724
|
W3 Total Cache [w3-total-cache] < 0.9.4.1 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Desconocido
|
< 0.9.4.1
|
0.9.4.1 |
2014-11-10 |
✓ corregido en la última versión
|
|
CVE-2014-9414
|
W3 Total Cache [w3-total-cache] < 0.9.4.1 |
Falsificación de petición en sitios cruzados (CSRF) |
Desconocido
|
< 0.9.4.1
|
0.9.4.1 |
2014-09-08 |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 0.9.4.1 |
— |
Desconocido
|
< 0.9.4.1
|
0.9.4.1 |
2014-09-08 |
✓ corregido en la última versión
|
|
CVE-2013-2010
|
W3 Total Cache [w3-total-cache] < 0.9.2.9 |
Neutralización incorrecta de elementos especiales en la salida usada por un componente posterior (inyección) |
Crítica
9,8
|
< 0.9.2.9
|
0.9.2.9 |
2014-08-01 |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 0.9.2.9 |
— |
Desconocido
|
< 0.9.2.9
|
0.9.2.9 |
2013-05-01 |
✓ corregido en la última versión
|
|
CVE-2026-5032
|
W3 Total Cache [w3-total-cache] < 2.9.4 |
— |
Desconocido
|
< 2.9.4
|
2.9.4 |
0000-00-00 |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 2.8.13 |
— |
Desconocido
|
< 2.8.13
|
2.8.13 |
0000-00-00 |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 0.9.7.4 |
— |
Desconocido
|
< 0.9.7.4
|
0.9.7.4 |
— |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 0.9.7.4 |
— |
Desconocido
|
< 0.9.7.4
|
0.9.7.4 |
— |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 0.9.7.4 |
— |
Desconocido
|
< 0.9.7.4
|
0.9.7.4 |
— |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 0.9.5 |
— |
Desconocido
|
< 0.9.5
|
0.9.5 |
— |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 0.9.5 |
— |
Desconocido
|
< 0.9.5
|
0.9.5 |
— |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 0.9.5 |
— |
Desconocido
|
< 0.9.5
|
0.9.5 |
— |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 0.9.5 |
— |
Desconocido
|
< 0.9.5
|
0.9.5 |
— |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 0.9.5 |
— |
Desconocido
|
< 0.9.5
|
0.9.5 |
— |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 0.9.5 |
— |
Desconocido
|
< 0.9.5
|
0.9.5 |
— |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 0.9.5 |
— |
Desconocido
|
< 0.9.5
|
0.9.5 |
— |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 0.9.5 |
— |
Desconocido
|
< 0.9.5
|
0.9.5 |
— |
✓ corregido en la última versión
|
|
—
|
W3 Total Cache [w3-total-cache] < 0.9.4.1 |
— |
Desconocido
|
< 0.9.4.1
|
0.9.4.1 |
— |
✓ corregido en la última versión
|
CVE-2022-31090
Guzzle, an extensible PHP HTTP client. `Authorization` headers on requests are sensitive information. In affected versions when using our Curl handler, it is possible to use the `CURLOPT_HTTPAUTH` option to specify an `Authorization` header. On making a request which responds with a redirect to a URI with a different origin (change in host, scheme or port), if we choose to follow it, we should remove the `CURLOPT_HTTPAUTH` option before continuing, stopping curl from appending the `Authorization` header to the new request. Affected Guzzle 7 users should upgrade to Guzzle 7.4.5 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.8 or 7.4.5. Note that a partial fix was implemented in Guzzle 7.4.2, where a change in host would trigger removal of the curl-added Authorization header, however this earlier fix did not cover change in scheme or change in port. If you do not require or expect redirects to be followed, one should simply disable redirects all together. Alternatively, one can specify to use the Guzzle steam handler backend, rather than curl. *Please note that while some WordPress plugins and themes may use this as a dependency, they may not be directly exploitable.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2021-24452
The W3 Total Cache WordPress plugin before 2.1.5 was affected by a reflected Cross-Site Scripting (XSS) issue within the "extension" parameter in the Extensions dashboard, when the 'Anonymously track usage to improve product quality' setting is enabled, as the parameter is output in a JavaScript context without proper escaping. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2021-24436
The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" parameter in the Extensions dashboard, which is output in an attribute without being escaped first. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2021-24427
The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several CDN settings in versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2012-6078
W3 Total Cache before 0.9.2.5 generates hash keys insecurely which allows remote attackers to predict the values of the hashes.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2012-6077
W3 Total Cache before 0.9.2.5 allows remote attackers to retrieve password hash information due to insecure storage of database cache files.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2012-6079
W3 Total Cache before 0.9.2.5 exposes sensitive cached database information which allows remote attackers to download this information via their hash keys.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
W3 Total Cache [w3-total-cache] < 0.9.7.4
The W3 Total Cache plugin for WordPress is vulnerable to Server Side Request Forgery in versions up to, and including 0.9.7.3, due to insufficient user input validation in the opcache_flush_file file.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
W3 Total Cache [w3-total-cache] < 0.9.7.4
Cross-Site Scripting (XSS) vulnerability found by Thomas Chauchefoin in WordPress W3 Total Cache plugin (versions <= 0.9.7.3).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
W3 Total Cache [w3-total-cache] < 0.9.7.4
W3 Total Cache in versions 0.5 up to 0.9.7.3 does not sufficiently validate the "openssl_verify" result in "/services/MessageValidator/MessageValidator.php". A remote attacker can create a specially crafted certificate and bypass cryptographic checks.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
W3 Total Cache [w3-total-cache] < 0.9.7.4
The W3 Total Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to insufficient input validation on the $command variable, which makes it possible for attackers to inject arbitrary web sites in victims browsers in versions up to, and including, 0.9.7.3.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2019-6715
The script pub/sns.php in the W3 Total Cache plugin (versions 0.9.2.6 through 0.9.3) allows remote attackers to read arbitrary files via the SubscribeURL field in SubscriptionConfirmation JSON data.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
W3 Total Cache [w3-total-cache] < 0.9.5
The W3 Total Cache plugin for WordPress is vulnerable to weak validation of Amazon SNS push messages in versions up to, and including, 0.9.4.1. This makes it possible for attackers to perform a variety of actions concerning the server's cache, such as performing a Denial of Service attack on the site.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
W3 Total Cache [w3-total-cache] < 0.9.5
The W3 Total Cache plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 0.9.4. This is due to a minify function incorrectly restricting path input. This makes it possible for attackers to access restricted resources on private networks by using a vulnerable installation as a limited HTTP GET proxy.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
W3 Total Cache [w3-total-cache] < 0.9.5
This plugin is prone to unauthenticated security token bypass vulnerability.
Update the plugin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
W3 Total Cache [w3-total-cache] < 0.9.5
This plugin is prone to an authenticated arbitrary file upload vulnerability.
Update the plugin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
W3 Total Cache [w3-total-cache] < 0.9.5
This plugin is prone to authenticated arbitrary file download vulnerability.
Update the plugin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
W3 Total Cache [w3-total-cache] < 0.9.5
This plugin is prone to an authenticated arbitrary PHP code execution vulnerability.
Update the plugin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
W3 Total Cache [w3-total-cache] < 0.9.5
Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code.
Update the plugin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
W3 Total Cache [w3-total-cache] < 0.9.5
The W3 Total Cache plugin for WordPress is vulnerable to authorization bypass due to the use of loose comparison on the nonce value in the /pub/apc.php file. This affects versions up to, and including, 0.9.4.1. This makes it possible for attackers to bypass nonce protections if a valid nonce starts with 0e. In the right situation this bypass can be used to empty the OPCache.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
W3 Total Cache [w3-total-cache] < 0.9.5
The W3 Total Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in versions up to, and including, 0.9.4.1. This makes it possible for authenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
W3 Total Cache [w3-total-cache] < 0.9.5
The W3 Total Cache plugin for WordPress is vulnerable to Arbitrary File Download in versions up to, and including, 0.9.4.1 This can allow an administrator attacker to extract sensitive data from wp-config.php that could be used to fully take over the site.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
W3 Total Cache [w3-total-cache] < 0.9.5
The W3 Total Cache plugin for WordPress is vulnerable to Authenticated Arbitrary Code Execution via settings import in versions up to, and including, 0.9.4.1. This makes it possible for authenticated attackers to inject and execute arbitrary code.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
W3 Total Cache [w3-total-cache] < 0.9.5
The W3 Total Cache plugin plugin for WordPress is vulnerable to Cross-Site Scripting via the 'request_id' parameter in versions up to, and including, 0.9.4.1 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
W3 Total Cache [w3-total-cache] < 0.9.4.1
This plugin is prone to edge mode enabling cross site request forgery vulnerability.
Update the plugin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2014-8724
Cross-site scripting (XSS) vulnerability in the W3 Total Cache plugin before 0.9.4.1 for WordPress, when debug mode is enabled, allows remote attackers to inject arbitrary web script or HTML via the "Cache key" in the HTML-Comments, as demonstrated by the PATH_INFO to the default URI.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2014-9414
The W3 Total Cache plugin before 0.9.4.1 for WordPress does not properly handle empty nonces, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and hijack the authentication of administrators for requests that change the mobile site redirect URI via the mobile_groups[*][redirect] parameter and an empty _wpnonce parameter in the w3tc_mobile page to wp-admin/admin.php.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
W3 Total Cache [w3-total-cache] < 0.9.4.1
The W3 Total Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.9.4. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2013-2010
The W3 Total Cache WordPress plugin was affected by a Remote Code Execution security vulnerability.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
W3 Total Cache [w3-total-cache] < 0.9.2.9
W3 Total Cache plugin is prone to a PHP code execution vulnerability because of the handling of certain macros such as "mfunc" that allows arbitrary PHP code injection.
Update the WordPress W3 Total Cache plugin to the latest available version (at least 0.9.2.9).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2026-5032
The W3 Total Cache plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 2.9.3. This is due to the plugin bypassing its entire output buffering and processing pipeline when the request's User-Agent header contains "W3 Total Cache", which causes raw mfunc/mclude dynamic fragment HTML comments — including the W3TC_DYNAMIC_SECURITY security token — to be rendered in the page source. This makes it possible for unauthenticated attackers to discover the value of the W3TC_DYNAMIC_SECURITY constant by sending a crafted User-Agent header to any page that contains developer-placed dynamic fragment tags, granted the site has the fragment caching feature enabled. With the leaked W3TC_DYNAMIC_SECURITY token, an attacker can craft valid mfunc tags to execute arbitrary PHP code on the server, achieving remote code execution.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
W3 Total Cache [w3-total-cache] < 2.8.13
The W3 Total Cache plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.8.12 via _parse_dynamic_mfunc . This makes it possible for unauthenticated attackers to execute code on the server when comments are enabled and a post has been incorrectly injected with the mfunc tags. Please note we consider this to be a theoretical issue, and as such we rejected the original report from the researcher who then submitted this to WPScan. WPScan assigned a CVE ID, but we do not agree that this is a true security vulnerability. Exploitation of this issue is theoretical and requires gaining access to a secret value much like gaining access to a password.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
W3 Total Cache [w3-total-cache] < 0.9.7.4
The return value of `openssl_verify` is not properly validated, which allows to bypass the cryptographic check.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
W3 Total Cache [w3-total-cache] < 0.9.7.4
The implementation of `opcache_flush_file` calls `file_exists` with a parameter fully controlled by the user.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
W3 Total Cache [w3-total-cache] < 0.9.7.4
The W3 Total Cache WordPress plugin was affected by a Cross-Site Scripting (XSS) security vulnerability.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
W3 Total Cache [w3-total-cache] < 0.9.5
The W3 Total Cache WordPress plugin was affected by a Weak Validation of Amazon SNS Push Messages security vulnerability.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
W3 Total Cache [w3-total-cache] < 0.9.5
The W3 Total Cache WordPress plugin was affected by an Information Disclosure Race Condition security vulnerability.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
W3 Total Cache [w3-total-cache] < 0.9.5
The W3 Total Cache WordPress plugin was affected by an Unauthenticated Server Side Request Forgery (SSRF) security vulnerability.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
W3 Total Cache [w3-total-cache] < 0.9.5
When you're creating a support ticket in the plugin page, you can add one or more of your your template themes.
Then this file will be send to the author to help him resolving the issue.
Now you select one, you send the form and same as for the files before, you will send it to the author to help him to fix the issue.
How does it work:
**********
/**
* Attach templates
*/
foreach ($templates as $template) {
if (!empty($template)) {
$attachments[] = $template;
}
}
**********
foreach ($attachments as $attachment) {
if (is_network_admin())
update_site_option('attachment_' . md5($attachment), $attachment);
else
update_option('attachment_' . md5($attachment), $attachment);
}
**********
/**
* Remove temporary files
*/
foreach ($attachments as $attachment) {
// ...
if (is_network_admin())
delete_site_option('attachment_' . md5($attachment));
else
delete_option('attachment_' . md5($attachment));
}
**********
$attachment_location = filter_var(urldecode($_REQUEST['file']), FILTER_SANITIZE_STRING);
$md5 = md5($attachment_location);
$nonce = $_REQUEST['nonce'];
$stored_nonce = get_site_option('w3tc_support_request') ? get_site_option('w3tc_support_request') : get_option('w3tc_support_request');
$stored_attachment = get_site_option('w3tc_support_request') ? get_site_option('attachment_' . $md5) : get_option('attachment_' . $md5);
if (file_exists($attachment_location) && $nonce == $stored_nonce && !empty($stored_nonce) && $stored_attachment == $attachment_location) {
**********
First, our choices are added to the attachments array, second an option is added, this will be used to be sure that this file was chosen from this support form, then this options are deleted when the submission is done.
Between the option creation and delete that the files.php is called to get the attachment, verified with a nonce and with the created option.
The vulnerability stays in the fact that we can modify – using firebug for example – the templates name to another existing file from the site, like wp-config.php.
So now, an option has been created with this fake theme template. Then using the same type juggling flaw as before, I can validate the nonce because of the ==.
You also have to add a 20 Mb file to gain time to exploit this.
Pointing on the files.php URL like that can help me to download the wp-config.php, because for the same reason as before, an administrator is not always allowed to read the config file, he's not the webmaster but a WordPress administrator, so this represent a vulnerability.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
W3 Total Cache [w3-total-cache] < 0.9.5
When you're creating a support ticket in the plugin page, you can add one or more of your files from your computer.
Then this file will be send to the author to help him resolving the issue.
When we look at the code, W3TC is doing that:
**********
/**
* Attach other files
*/
if (!empty($_FILES['files'])) {
$files = (array)$_FILES['files'];
for ($i = 0, $l = count($files); $i < $l; $i++) {
if (isset($files['tmp_name'][$i]) && isset($files['name'][$i]) && isset($files['error'][$i]) && $files['error'][$i] == UPLOAD_ERR_OK) {
$path = W3TC_CACHE_TMP_DIR . '/' . $files['name'][$i];
if (@move_uploaded_file($files['tmp_name'][$i], $path)) {
$attachments[] = $path;
}
}
}
}
**********
and
**********
/**
* Remove temporary files
*/
foreach ($attachments as $attachment) {
if (strstr($attachment, W3TC_CACHE_TMP_DIR) !== false) {
@unlink($attachment);
}
**********
Ok, so, when you submit the form as an administrator, W3TC uploads our file in its temporary folder /wp-content/cache/tmp/ then will delete them right after that, the file will live only a few milliseconds.
But what if I try to send 2 files, the first one is a 2 Kb malicious PHP file containing a backdoor, the second one is a 20 Mb file. The submission will last more longer, the first file won't be deleted since the second one is not uploaded, I can now access to the first file.
An administrator is not always allowed to execute custom PHP code, he's not the webmaster but a WordPress administrator, so this represent a vulnerability.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
W3 Total Cache [w3-total-cache] < 0.9.5
This one is so mush easy to exploit using the import settings feature, this is what W3TC will do one your file is uploaded:
**********
/**
* Imports config content
*
* @param string $filename
* @return boolean
*/
function import($filename) {
if (file_exists($filename) && is_readable($filename)) {
$data = file_get_contents($filename);
if (substr($data, 0, 5) == '<?php')
$data = substr($data, 5);
$config = eval($data);
if (is_array($config)) {
foreach ($config as $key => $value)
$this->set($key, $value);
return true;
}
}
return false;
}
**********
The bad line is $config = eval($data); because it means that all my file content will be evaluated like any other PHP code. Basically we can send a PHP script that will create a backdoor.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
W3 Total Cache [w3-total-cache] < 0.9.5
The /pub/apc.php file is used to empty the OPCache/APC. The script seems protected by a nonce (aka security token):
***********
$nonce = W3_Request::get_string('nonce');
$uri = $_SERVER['REQUEST_URI'];
if (wp_hash($uri) == $nonce) {
************
But the flaw stays in the == operator which is not the one to use when you want to compare hashes because of php type juggling.
You can find an example of type juggling on https://3v4l.org/tT4l8
To exploit the vulnerability, the token has to start with `0e` and all other chars have to be numbers, then the user can just add a param in the url like `?nonce=0` and it will be validated.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
W3 Total Cache [w3-total-cache] < 0.9.5
The W3 Total Cache WordPress plugin was affected by an Authenticated Reflected Cross-Site Scripting (XSS) security vulnerability.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
W3 Total Cache [w3-total-cache] < 0.9.4.1
The W3 Total Cache WordPress plugin was affected by an Edge Mode Enabling CSRF security vulnerability.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
Mantén W3 Total Cache actualizado — 2.10.2 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").
Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.