The W3 Total Cache plugin for WordPress contains a flaw whereby an attacker can send a crafted User‑Agent header that contains the string "W3 Total Cache" to bypass the plugin’s output filtering. This bypass leaks raw mfunc/mclude dynamic fragment HTML comments, including the W3TC_DYNAMIC_SECURITY security token, into the rendered page source. An unauthenticated attacker who obtains this token can inject mfunc tags that execute arbitrary PHP code on the server, leading to full remote code execution.

All WordPress sites using the BoldGrid W3 Total Cache plugin at or below version 2.9.3 are affected. The issue requires that the fragment caching feature be enabled and that the site contain developer‑placed dynamic fragment tags. Versions newer than 2.9.3 are not vulnerable.

The flaw has a CVSS base score of 7.5, indicating high severity, and an EPSS score of less than 1 %, suggesting a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Because authentication is not required and the required payload is a specially crafted HTTP request, the likely attack vector is remote over the web. Administrators should assess whether any site meets the prerequisites and apply the recommended fix promptly.