Summary
CVE-2026-57623 is a critical unauthenticated arbitrary code execution vulnerability affecting W3 Total Cache versions 2.9.4 and below, a widely deployed WordPress caching plugin developed by BoldGrid with over one million active installations. The flaw requires no authentication and no user interaction, enabling remote attackers to execute arbitrary code on affected WordPress servers. It carries a CVSS v3.1 base score of 9.0.
Technical details
- Root cause: The vulnerability stems from improper validation of input within the plugin’s processing logic (CWE-1284: Improper Validation of Specified Quantity in Input), allowing malicious input to be executed as code on the server.
- Trigger conditions: Exploitation is network-accessible and requires no authentication (PR:N, UI:N). Attack complexity is rated High (AC:H), indicating that a specific server-side condition must be present for exploitation to succeed.
- Attack vector: Network — an unauthenticated remote attacker can trigger the vulnerability over HTTP/HTTPS against any internet-exposed WordPress site running a vulnerable version of the plugin.
- Impact: Full remote code execution on the hosting server, with high impact to Confidentiality, Integrity, and Availability. Scope is changed (S:C), meaning successful exploitation can affect resources beyond the vulnerable plugin itself, including the broader WordPress installation and underlying server.
Affected software
- W3 Total Cache (vendor: BoldGrid) — all versions up to and including 2.9.4
Severity
- CVSS v3.1 Base Score: 9.0 (Critical)
- Vector string:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate — upgrade to the patched version: Update W3 Total Cache to version 2.10.0 or later, which was released by BoldGrid as a dedicated security release and addresses this vulnerability.
- Verify plugin version: Log into the WordPress admin dashboard and confirm the installed W3 Total Cache version. WordPress may not auto-update plugins — manual verification is recommended.
- If immediate patching is not possible: Consider temporarily deactivating the W3 Total Cache plugin until the update can be applied, and restrict public access to the WordPress admin interface at the network level.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

