Plugin security history

W3 Total Cache Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 32 vulnerability records associated with W3 Total Cache, published between 2014 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

32Total records

2Critical

16High

12Medium

2Low

0Informational

32Patched records

0Currently marked unpatched

2014-08-01First disclosure

2026-07-10Latest disclosure

21 of 32CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2014	4	4 records
2016	7	7 records
2019	3	3 records
2020	4	4 records
2021	3	3 records
2022	1	1 records
2024	1	1 records
2025	4	4 records
2026	5	5 records

Severity Breakdown

Severity	Records	Share
Critical	2	6.3%
High	16	50%
Medium	12	37.5%
Low	2	6.3%

Vulnerability-Type Breakdown

Other

9 records28.1%

First: 2014. Latest: 2026.

Information Disclosure

9 records28.1%

First: 2016. Latest: 2026.

Cross-Site Scripting

6 records18.8%

First: 2014. Latest: 2021.

Missing Authorization

3 records9.4%

First: 2025. Latest: 2026.

CSRF

2 records6.3%

First: 2014. Latest: 2014.

Authentication Bypass

1 record3.1%

First: 2016. Latest: 2016.

Arbitrary File Upload

1 record3.1%

First: 2016. Latest: 2016.

Path Traversal

1 record3.1%

First: 2026. Latest: 2026.

Patch Status

Patched: 32
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

2.10.0
2.9.4
2.9.2
2.8.13
2.8.2
2.7.6
2.2.3
2.1.5
2.1.4
2.1.3
0.9.4
0.9.2.5
0.9.7.4
0.9.5
0.9.4.1
0.9.2.9

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-2.9.4`	W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter	July 10, 2026	2.10.0	High
`*-2.9.4`	W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary Code Execution	June 29, 2026	2.10.0	High
`*-2.9.3`	W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header	April 1, 2026	2.9.4	High
`*-2.9.1`	W3 Total Cache <= 2.9.1 - Missing Authorization	March 12, 2026	2.9.2	Medium
`*-2.9.1`	W3 Total Cache <= 2.9.1 - Unauthenticated Arbitrary Code Execution	February 24, 2026	2.9.2	Critical
`*-2.8.12`	W3 Total Cache <= 2.8.12 - Unauthenticated Command Injection	October 27, 2025	2.8.13	High
`*-2.8.1`	W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery	January 13, 2025	2.8.2	High
`*-2.8.1`	W3 Total Cache <= 2.8.1 Information Exposure via Log Files	January 13, 2025	2.8.2	Medium
`*-2.8.1`	W3 Total Cache <= 2.8.1 Missing Authorization to Unauthenticated Plugin Deactivation and Extensions Activation/Deactivation	January 13, 2025	2.8.2	Medium
`*-2.7.5`	W3 Total Cache <= 2.7.5 - Sensitive Credentials Stored in Plaintext	September 23, 2024	2.7.6	Low
`*-2.2.2`	Guzzle <= 6.5.7 and 7.0-7.4.4 - Information Exposure	June 20, 2022	2.2.3	High
`0.5-2.1.4`	W3 Total Cache <= 2.1.4 - Reflected Cross-Site Scripting via extension	June 28, 2021	2.1.5	High
`[*, 2.1.4)`	W3 Total Cache <= 2.1.3 - Reflected Cross-Site Scripting via extension	June 28, 2021	2.1.4	Medium
`[*, 2.1.3)`	W3 Total Cache <= 2.1.2 Authenticated (Admin+) Stored Cross-Site Scripting	June 16, 2021	2.1.3	Medium
`0.9.2.6-0.9.3`	W3 Total Cache 0.9.2.6-0.9.3 - File Read / Directory Traversal	December 22, 2020	0.9.4	High
`*-0.9.2.4`	W3 Total Cache <= 0.9.2.4 - Insecure Cryptography to Sensitive Information Disclosure	September 22, 2020	0.9.2.5	High
`*-0.9.2.4`	W3 Total Cache <= 0.9.2.4 - Sensitive Information Exposure	September 22, 2020	0.9.2.5	High
`*-0.9.2.4`	W3 Total Cache <= 0.9.2.4 - Password Hash Extraction	September 22, 2020	0.9.2.5	High
`*-0.9.7.3`	W3 Total Cache <= 0.9.7.3 - Server Side Request Forgery	May 22, 2019	0.9.7.4	Medium
`*-0.9.7.3`	W3 Total Cache plugin <= 0.9.7.3 - Reflected Cross-Site Scripting	May 7, 2019	0.9.7.4	Medium
`*-0.9.7.3`	W3 Total Cache <= 0.9.7.3 - Improper Input Validation via openssl_verify	May 7, 2019	0.9.7.4	Medium
`*-0.9.4.1`	W3 Total Cache <= 0.9.4.1 - Weak validation of Amazon SNS push messages	November 10, 2016	0.9.5	High
`*-0.9.4`	W3 Total Cache <= 0.9.4 - Server-Side Request Forgery leading to Host Information Disclosure	October 31, 2016	0.9.5	High
`*-0.9.4.1`	W3 Total Cache <= 0.9.4.1 - Arbitrary Code Execution via settings import	September 26, 2016	0.9.5	High
`*-0.9.4.1`	W3 Total Cache <= 0.9.4.1 - Authenticated Arbitrary File Download	September 26, 2016	0.9.5	Medium

Selected source records

Latest Records

HighCVE-2026-9282

W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter

Published: July 10, 2026

Affected versions: *-2.9.4
Patched versions: 2.10.0

Original Wordfence record

HighCVE-2026-57623

W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary Code Execution

Published: June 29, 2026

Affected versions: *-2.9.4
Patched versions: 2.10.0

Original Wordfence record

HighCVE-2026-5032

W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header

Published: April 1, 2026

Affected versions: *-2.9.3
Patched versions: 2.9.4

Original Wordfence record

MediumCVE-2026-39595

W3 Total Cache <= 2.9.1 - Missing Authorization

Published: March 12, 2026

Affected versions: *-2.9.1
Patched versions: 2.9.2

Original Wordfence record

CriticalCVE-2026-27384

W3 Total Cache <= 2.9.1 - Unauthenticated Arbitrary Code Execution

Published: February 24, 2026

Affected versions: *-2.9.1
Patched versions: 2.9.2

Original Wordfence record

HighCVE-2025-9501

W3 Total Cache <= 2.8.12 - Unauthenticated Command Injection

Published: October 27, 2025

Affected versions: *-2.8.12
Patched versions: 2.8.13

Original Wordfence record

HighCVE-2024-12365

W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery

Published: January 13, 2025

Affected versions: *-2.8.1
Patched versions: 2.8.2

Original Wordfence record

MediumCVE-2024-12006

W3 Total Cache <= 2.8.1 Missing Authorization to Unauthenticated Plugin Deactivation and Extensions Activation/Deactivation

Published: January 13, 2025

Affected versions: *-2.8.1
Patched versions: 2.8.2

Original Wordfence record

Highest-Severity Records

CriticalCVE-2013-2010

W3 Total Cache <= 0.9.2.8 - Remote Code Execution

Published: August 1, 2014

Affected versions: *-0.9.2.8
Patched versions: 0.9.2.9

Original Wordfence record

CriticalCVE-2026-27384

W3 Total Cache <= 2.9.1 - Unauthenticated Arbitrary Code Execution

Published: February 24, 2026

Affected versions: *-2.9.1
Patched versions: 2.9.2

Original Wordfence record

High

W3 Total Cache <= 0.9.4 - Cross-Site Request Forgery leading to Stored Cross-Site Scripting

Published: September 8, 2014

Affected versions: *-0.9.4
Patched versions: 0.9.4.1

Original Wordfence record

High

W3 Total Cache <= 0.9.4.1 - Arbitrary File Upload

Published: September 26, 2016

Affected versions: *-0.9.4.1
Patched versions: 0.9.5

Original Wordfence record

High

W3 Total Cache <= 0.9.4 - Server-Side Request Forgery leading to Host Information Disclosure

Published: October 31, 2016

Affected versions: *-0.9.4
Patched versions: 0.9.5

Original Wordfence record

HighCVE-2024-12365

W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery

Published: January 13, 2025

Affected versions: *-2.8.1
Patched versions: 2.8.2

Original Wordfence record

HighCVE-2025-9501

W3 Total Cache <= 2.8.12 - Unauthenticated Command Injection

Published: October 27, 2025

Affected versions: *-2.8.12
Patched versions: 2.8.13

Original Wordfence record

HighCVE-2026-57623

W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary Code Execution

Published: June 29, 2026

Affected versions: *-2.9.4
Patched versions: 2.10.0

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory