The W3 Total Cache WordPress plugin exposes the W3TC_DYNAMIC_SECURITY security token when a request includes a User-Agent header that contains W3 Total Cache. The plugin skips its output buffering process under this condition, causing raw dynamic fragment comments containing the token to be rendered in the page source. An unauthenticated attacker can send a crafted HTTP request to any page that uses developer-placed dynamic fragment tags, provided fragment caching is enabled, and thus learn the token value, resulting in information disclosure.

BoldGrid’s W3 Total Cache plugin for WordPress is affected in all versions up to and including 2.9.3. The vulnerability requires that fragment caching be enabled and that the page contains developer-placed dynamic fragment tags.

With a CVSS v3.1 base score of 7.5, this flaw is high severity. The attacker does not need authentication or special privileges; sending a basic HTTP request with a crafted User-Agent header that includes W3 Total Cache is sufficient to trigger the exploit, making it potentially easy to abuse. EPSS data is unavailable, and the vulnerability is not yet listed in the CISA KEV catalog.