Remote Code Execution via mfunc Sanitizer Bypass in W3 Total Cache Fragment Cache

W3 Total Cache up to 2.9.1 removes mfunc/mclude dynamic-fragment tags from comments and other user content with a pattern that misses tags written without a space after the keyword, and a crafted tag is reassembled into a valid one when the security token is stripped. An unauthenticated attacker who knows the site’s W3TC_DYNAMIC_SECURITY token can make the server execute arbitrary PHP code. Sites with fragment caching enabled are at risk.

This vulnerability affects the following application versions:

• W3 Total Cache 0.14.2
• W3 Total Cache 0.14.3
• W3 Total Cache 0.14.4
• W3 Total Cache 0.15.0
• W3 Total Cache 0.15.1
• W3 Total Cache 0.15.2
• W3 Total Cache 2.0.0
• W3 Total Cache 2.0.1
• W3 Total Cache 2.1.0
• W3 Total Cache 2.1.1
• W3 Total Cache 2.1.2
• W3 Total Cache 2.1.3
• W3 Total Cache 2.1.4
• W3 Total Cache 2.1.5
• W3 Total Cache 2.1.6
• W3 Total Cache 2.1.7
• W3 Total Cache 2.1.8
• W3 Total Cache 2.1.9
• W3 Total Cache 2.2.0
• W3 Total Cache 2.2.1
• W3 Total Cache 2.2.2
• W3 Total Cache 2.2.3
• W3 Total Cache 2.2.4
• W3 Total Cache 2.2.6
• W3 Total Cache 2.2.7
• W3 Total Cache 2.2.9
• W3 Total Cache 2.2.10
• W3 Total Cache 2.2.11
• W3 Total Cache 2.2.12
• W3 Total Cache 2.3.0
• W3 Total Cache 2.3.1
• W3 Total Cache 2.3.2
• W3 Total Cache 2.3.3
• W3 Total Cache 2.4.0
• W3 Total Cache 2.4.0-alpha.1
• W3 Total Cache 2.4.0-alpha.3
• W3 Total Cache 2.4.1
• W3 Total Cache 2.5.0
• W3 Total Cache 2.6.0
• W3 Total Cache 2.6.0-alpha.1
• W3 Total Cache 2.6.0-alpha.2
• W3 Total Cache 2.6.1
• W3 Total Cache 2.7.0
• W3 Total Cache 2.7.1
• W3 Total Cache 2.7.2
• W3 Total Cache 2.7.3
• W3 Total Cache 2.7.4
• W3 Total Cache 2.7.5
• W3 Total Cache 2.7.6
• W3 Total Cache 2.7.7
• W3 Total Cache 2.7.7-beta.1
• W3 Total Cache 2.8.0
• W3 Total Cache 2.8.1
• W3 Total Cache 2.8.2
• W3 Total Cache 2.8.3
• W3 Total Cache 2.8.4
• W3 Total Cache 2.8.5
• W3 Total Cache 2.8.6
• W3 Total Cache 2.8.7
• W3 Total Cache 2.8.8
• W3 Total Cache 2.8.9
• W3 Total Cache 2.8.10
• W3 Total Cache 2.8.11
• W3 Total Cache 2.8.12
• W3 Total Cache 2.8.13
• W3 Total Cache 2.8.14
• W3 Total Cache 2.8.15
• W3 Total Cache 2.9.0
• W3 Total Cache 2.9.1