CVE-2026-57623: WordPress W3 Total Cache plugin <= 2.9.4 - Arbitrary Code Execution vulnerability

Synopsis

An unauthenticated arbitrary code execution vulnerability affects the W3 Total Cache WordPress plugin at version 2.9.4 and earlier. The flaw is reachable over the network without any login or credentials, and the CVSS vector indicates high attack complexity due to environmental or race-condition factors. Successful exploitation gives an attacker full read, write, and availability control over the affected system, with scope extending beyond the vulnerable component itself. HarborGuard is tracking the upstream advisory for patch availability and will make a patched-image rebuild available as soon as a fix version is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the vulnerable service over the network; no prior foothold on the host is needed.

• AuthenticationNot required

  No credentials or session token of any privilege level are required to trigger the vulnerability.

• Victim interactionNot required

  The attacker does not need any action from a logged-in user or administrator to complete the exploit.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must account for race conditions, specific memory layout, or other environmental factors that are not fully under their control.

Blast Radius

• A successful attacker executes arbitrary code on the host running the WordPress application, with no prior authentication barrier.
• The changed scope (S:C) means impact extends beyond the WordPress process itself, potentially reaching the underlying container or adjacent services sharing the same host.
• Confidentiality impact is High: the attacker reads stored files, environment variables, credentials, and any data accessible to the web server process.
• Integrity and availability impact are both High: the attacker writes or deletes files, injects persistent backdoors, and can crash or degrade the service at will.