CVE-2025-9501 — Vulnerability intelligence

— W3 Total Cache

Published: 2025-11-17T06:00:02.110Z

CVSS

9

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the _parse_dynamic_mfunc function, allowing unauthenticated users to execute PHP commands by submitting a comment with a malicious payload to a post.

Sources

• CVE-2025-9501
• Original advisory
• CVE-2025-9501