W3 Total Cache Plugin Vulnerability Exposes 1 Million WordPress Sites to Attacks

A critical bug in the W3 Total Cache plugin estimated to be installed on over a million WordPress websites has been discovered that could allow attackers to access a variety of information, including metadata on cloud-based applications.

The W3 Total Cache plugin uses multiple caching techniques to optimize your website speed, reduce load times, and improve overall SEO rankings.

The vulnerability is being tracked as CVE-2024-12365, and while the developer has released a fix in the latest version of the product, hundreds of thousands of sites will still need to install the patched variant.

Vulnerability details

Wordfence notes that the security issue stems from a missing capability check in the 'is_w3tc_admin_page' function in all versions up to the latest version 2.8.2. This bug allows access to the plugin's security nonce value and unauthorized actions. In theory, the vulnerability would be exploitable if the attacker were authenticated and had subscriber status, a condition that is easily met.

But the main risks that arise if CVE-2024-12365 is exploited include:

1. Server-Side Request Forgery (SSRF): makes web requests that can potentially expose sensitive data, including version metadata of cloud-based applications
2. Leaking information
3. Service abuse: using caching service limits, affecting website performance and possibly increasing costs

In terms of the practical impact of this vulnerability, an attacker could use the website's infrastructure to forward requests to other services and use the information gathered to carry out further attacks.

The most drastic action affected users can take is to upgrade to the latest version of W3 Total Cache, version 2.8.2, to address the security vulnerability.

Download statistics from wordpress.org show that around 150,000 websites installed the plugin after the developer released the latest update, leaving hundreds of thousands of WordPress websites still vulnerable.

As a general recommendation, website owners should avoid installing too many plugins and remove those that are not really needed. Additionally, a web application firewall can be useful in this case, helping to identify and block exploit attempts.

Kareem Winters

Update 20 January 2025