Read the docs
TI-2023-04932 Aliases CVE-2023-5359GHSA-8w9v-r586-45j6

W3 Total Cache <= 2.7.5 - Sensitive Credentials Stored in Plaintext

Priority LOW 34CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

The W3 Total Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.5 via Google OAuth API secrets stored in plaintext in the publicly visible plugin source. This can allow unauthenticated attackers to impersonate W3 Total Cache and gain access to user account information in successful conditions. This would not impact the WordPress users site in any way.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00813 57th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BoldGridW3 Total Cacheup to 2.7.5—No fix listedCNA
  • W3 Total Cache VendorBoldGrid Affected up to 2.7.5 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:boldgrid:w3_total_cache:*:*:*:*:*:wordpress:*:*before 2.7.6VulnerableBoldGrid
  • cpe:2.3:a:boldgrid:w3_total_cache:*:*:*:*:*:wordpress:*:* Versions before 2.7.6 Vulnerable ·BoldGrid

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-5359
  2. 2026-10-03 Alias added: GHSA-8w9v-r586-45j6

References

Patch 1

Advisory 1

Other 1

  • TI-2013-01782 WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2019-04758 pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote… CVSS 3.1HIGH 7.5
  • TI-2024-11141 W3 Total Cache <= 2.8.1 Information Exposure via Log Files CVSS 3.1HIGH 7.5
  • TI-2024-11471 W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery CVSS 3.1HIGH 8.5
  • TI-2012-05043 Information disclosure in W3 Total Cache CVSS 3.1HIGH 7.5
  • TI-2012-05042 Information disclosure in W3 Total Cache CVSS 3.1HIGH 7.5
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences