Remote Code Execution via mfunc Sanitizer Bypass in W3 Total Cache Fragment Cache

Skrevet den af i W3 Total Cache

W3 Total Cache up to 2.9.1 removes mfunc/mclude dynamic-fragment tags from comments and other user content with a pattern that misses tags written without a space after the keyword, and a crafted tag is reassembled into a valid one when the security token is stripped. An unauthenticated attacker who knows the site’s W3TC_DYNAMIC_SECURITY token can make the server execute arbitrary PHP code. Sites with fragment caching enabled are at risk.

This vulnerability affects the following application versions:

  • W3 Total Cache 0.14.2
  • W3 Total Cache 0.14.3
  • W3 Total Cache 0.14.4
  • W3 Total Cache 0.15.0
  • W3 Total Cache 0.15.1
  • W3 Total Cache 0.15.2
  • W3 Total Cache 2.0.0
  • W3 Total Cache 2.0.1
  • W3 Total Cache 2.1.0
  • W3 Total Cache 2.1.1
  • W3 Total Cache 2.1.2
  • W3 Total Cache 2.1.3
  • W3 Total Cache 2.1.4
  • W3 Total Cache 2.1.5
  • W3 Total Cache 2.1.6
  • W3 Total Cache 2.1.7
  • W3 Total Cache 2.1.8
  • W3 Total Cache 2.1.9
  • W3 Total Cache 2.2.0
  • W3 Total Cache 2.2.1
  • W3 Total Cache 2.2.2
  • W3 Total Cache 2.2.3
  • W3 Total Cache 2.2.4
  • W3 Total Cache 2.2.6
  • W3 Total Cache 2.2.7
  • W3 Total Cache 2.2.9
  • W3 Total Cache 2.2.10
  • W3 Total Cache 2.2.11
  • W3 Total Cache 2.2.12
  • W3 Total Cache 2.3.0
  • W3 Total Cache 2.3.1
  • W3 Total Cache 2.3.2
  • W3 Total Cache 2.3.3
  • W3 Total Cache 2.4.0
  • W3 Total Cache 2.4.0-alpha.1
  • W3 Total Cache 2.4.0-alpha.3
  • W3 Total Cache 2.4.1
  • W3 Total Cache 2.5.0
  • W3 Total Cache 2.6.0
  • W3 Total Cache 2.6.0-alpha.1
  • W3 Total Cache 2.6.0-alpha.2
  • W3 Total Cache 2.6.1
  • W3 Total Cache 2.7.0
  • W3 Total Cache 2.7.1
  • W3 Total Cache 2.7.2
  • W3 Total Cache 2.7.3
  • W3 Total Cache 2.7.4
  • W3 Total Cache 2.7.5
  • W3 Total Cache 2.7.6
  • W3 Total Cache 2.7.7
  • W3 Total Cache 2.7.7-beta.1
  • W3 Total Cache 2.8.0
  • W3 Total Cache 2.8.1
  • W3 Total Cache 2.8.2
  • W3 Total Cache 2.8.3
  • W3 Total Cache 2.8.4
  • W3 Total Cache 2.8.5
  • W3 Total Cache 2.8.6
  • W3 Total Cache 2.8.7
  • W3 Total Cache 2.8.8
  • W3 Total Cache 2.8.9
  • W3 Total Cache 2.8.10
  • W3 Total Cache 2.8.11
  • W3 Total Cache 2.8.12
  • W3 Total Cache 2.8.13
  • W3 Total Cache 2.8.14
  • W3 Total Cache 2.8.15
  • W3 Total Cache 2.9.0
  • W3 Total Cache 2.9.1

Missing Authorization to Unauthenticated Activation/Deactivation

Skrevet den af i W3 Total Cache

Due to a missing capability check on several functions in all versions up to, and including, 2.8.1, makes it possible for unauthenticated attackers to deactivate the plugin as well as activate and deactivate plugin extensions.

This vulnerability affects the following application versions:

  • W3 Total Cache 0.9.6
  • W3 Total Cache 0.9.7
  • W3 Total Cache 0.9.7.1
  • W3 Total Cache 0.9.7.2
  • W3 Total Cache 0.9.7.3
  • W3 Total Cache 0.9.7.4
  • W3 Total Cache 0.9.7.5
  • W3 Total Cache 0.10.0
  • W3 Total Cache 0.10.1
  • W3 Total Cache 0.10.2
  • W3 Total Cache 0.11.0
  • W3 Total Cache 0.12.0
  • W3 Total Cache 0.13.0
  • W3 Total Cache 0.13.1
  • W3 Total Cache 0.13.2
  • W3 Total Cache 0.13.3
  • W3 Total Cache 0.14.0
  • W3 Total Cache 0.14.1
  • W3 Total Cache 0.14.2
  • W3 Total Cache 0.14.3
  • W3 Total Cache 0.14.4
  • W3 Total Cache 0.15.0
  • W3 Total Cache 0.15.1
  • W3 Total Cache 0.15.2
  • W3 Total Cache 2.0.0
  • W3 Total Cache 2.0.1
  • W3 Total Cache 2.1.0
  • W3 Total Cache 2.1.1
  • W3 Total Cache 2.1.2
  • W3 Total Cache 2.1.3
  • W3 Total Cache 2.1.4
  • W3 Total Cache 2.1.5
  • W3 Total Cache 2.1.6
  • W3 Total Cache 2.1.7
  • W3 Total Cache 2.1.8
  • W3 Total Cache 2.1.9
  • W3 Total Cache 2.2.0
  • W3 Total Cache 2.2.1
  • W3 Total Cache 2.2.2
  • W3 Total Cache 2.2.3
  • W3 Total Cache 2.2.4
  • W3 Total Cache 2.2.6
  • W3 Total Cache 2.2.7
  • W3 Total Cache 2.2.9
  • W3 Total Cache 2.2.10
  • W3 Total Cache 2.2.11
  • W3 Total Cache 2.2.12
  • W3 Total Cache 2.3.0
  • W3 Total Cache 2.3.1
  • W3 Total Cache 2.3.2
  • W3 Total Cache 2.3.3
  • W3 Total Cache 2.4.0
  • W3 Total Cache 2.4.0-alpha.1
  • W3 Total Cache 2.4.0-alpha.3
  • W3 Total Cache 2.4.1
  • W3 Total Cache 2.5.0
  • W3 Total Cache 2.6.0
  • W3 Total Cache 2.6.0-alpha.1
  • W3 Total Cache 2.6.0-alpha.2
  • W3 Total Cache 2.6.1
  • W3 Total Cache 2.7.0
  • W3 Total Cache 2.7.1
  • W3 Total Cache 2.7.2
  • W3 Total Cache 2.7.3
  • W3 Total Cache 2.7.4
  • W3 Total Cache 2.7.5
  • W3 Total Cache 2.7.6
  • W3 Total Cache 2.7.7
  • W3 Total Cache 2.7.7-beta.1
  • W3 Total Cache 2.8.0
  • W3 Total Cache 2.8.1

Missing authorization to Server-Side Request Forgery

Skrevet den af i W3 Total Cache

Plugin is vulnerable to unauthorized access of data due to a missing capability check on the is_w3tc_admin_page function in all versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain the plugin’s nonce value and perform unauthorized actions, resulting in information disclosure, service plan limits consumption as well as making web requests to arbitrary locations originating from the web application that can be used to query information from internal services, including instance metadata on cloud-based applications.

CVE-2024-12365

This vulnerability affects the following application versions:

  • W3 Total Cache 2.4.0
  • W3 Total Cache 2.4.0-alpha.1
  • W3 Total Cache 2.4.0-alpha.3
  • W3 Total Cache 2.4.1
  • W3 Total Cache 2.5.0
  • W3 Total Cache 2.6.0
  • W3 Total Cache 2.6.0-alpha.1
  • W3 Total Cache 2.6.0-alpha.2
  • W3 Total Cache 2.6.1
  • W3 Total Cache 2.7.0
  • W3 Total Cache 2.7.1
  • W3 Total Cache 2.7.2
  • W3 Total Cache 2.7.3
  • W3 Total Cache 2.7.4
  • W3 Total Cache 2.7.5
  • W3 Total Cache 2.7.6
  • W3 Total Cache 2.7.7
  • W3 Total Cache 2.7.7-beta.1
  • W3 Total Cache 2.8.0
  • W3 Total Cache 2.8.1