CVE-2025-9501

CVE-2025-9501 is an unauthenticated command injection flaw in the W3 Total Cache WordPress plugin, located in the _parse_dynamic_mfunc function and affecting all versions before 2.8.13. An attacker triggers it by submitting a comment containing a crafted payload to a post on a site running the plugin, causing the injected PHP commands to be parsed and executed; the CVSS high attack complexity (AC:H) indicates certain site conditions must align for exploitation to succeed. Successful exploitation grants arbitrary PHP code/command execution on the web server, and the changed scope in the CVSS vector (S:C) means impact can extend beyond the plugin to the broader hosting environment with high confidentiality, integrity, and availability impact. Any WordPress site running W3 Total Cache prior to 2.8.13 is affected, regardless of the visitor's privileges since the attack requires no authentication and no user interaction. There is currently no known public PoC, the flaw is not in CISA KEV, but EPSS puts the probability of exploitation within 30 days at 20.5% (97th percentile), signaling elevated near-term risk.

What to do: Upgrade W3 Total Cache to version 2.8.13 or later on all affected sites. As an interim mitigation, restrict or moderate comment submission on cached posts (or temporarily disable the plugin) and review recent comments for crafted payloads containing PHP/mfunc-style tags. Although there is no public PoC or KEV listing yet, the elevated EPSS (20.5%, 97th percentile) justifies prioritized patching.