- Vulnerability was discovered in the W3 Total Cache WordPress plugin, allowing for data exposure and more
- It affects all versions up to 2.8.2, which was released as a response
- Hundreds of thousands of WordPress sites are still vulnerable
W3 Total Cache, a popular WordPress website performance optimization plugin, reportedly carried a high-severity vulnerability that allowed attackers to access sensitive information, abuse service plan limits, and perform unauthorized actions.
The vulnerability is tracked as CVE-2024-12365 and has a severity rating of 8.5/10 (high). It occurs due to a missing capability check in a function and affects all versions up to and including 2.8.1.
“This allows authorized attackers, with access at the subscriber level and above, to obtain the plugin’s nonce value and perform unauthorized actions, resulting in information disclosure, service plan throttling consumption, and making web requests to arbitrary locations originating from the web application, that can be used to query information from internal services, including instance metadata on cloud-based applications,” it read on the National Vulnerability Database website.
WordPress and its plugins
The WordPress plugin repository indicates that W3 Total Cache has more than a million downloads, with less than half (42.8% running the latest version), meaning more than 500,000 sites may still be vulnerable.
The plugin’s vendor, BoldGrid, has released a fix with its version 2.8.2, and WordPress security project Wordfence encouraged all users to apply the fix immediately.
WordPress is the world’s most popular website building platform, powering about half of all websites on the Internet.
As such, it is also a popular target for cybercriminals, but since the platform is relatively secure, threat actors are mostly focused on third-party plugins and themes, especially those with poor developer or community support.
W3 Total Cache is a powerful WordPress plugin designed to improve website performance by caching content, minimizing code and optimizing server resources. It claims to be able to help reduce load times, improve user experience and improve SEO by integrating features like content delivery network (CDN) and database caching.
Via Bleeping Computer
