The vulnerability is an unauthenticated arbitrary code execution flaw in the WordPress W3 Total Cache plugin versions 2.9.4 and earlier. Attackers can supply crafted input to the plugin and trigger execution of code on the host server, potentially gaining full control of the affected website. This defect is classified under CWE‑1284, indicating that the plugin mishandles untrusted data. Once exploited, an attacker can modify site content, install backdoors, steal credentials, or launch further attacks, jeopardizing confidentiality, integrity, and availability of the site and possibly the underlying server.

Vendors affected are BoldGrid, providing the W3 Total Cache plugin. Any installations using version 2.9.4 or any earlier release of the plugin are vulnerable. The reader should verify the installed plugin version against the affected range and update accordingly. No other categories or platforms are listed as affected in the current data.

The CVSS score of 9 flags this as a critical severity vulnerability, and the EPSS score is not available, indicating that detailed exploit probability data is lacking. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an unauthenticated network request to the WordPress site that triggers the plugin’s code path, meaning anyone with network access to the website can potentially exploit the flaw without authentication. The impact of exploitation is severe, as it affords complete control of the application server.