W3 Total Cache

W3 Total Cache through 2.10.5 can transform malicious comment content into executable script when Lazy Load Images and the non-default Process background images option are enabled. An unauthenticated commenter supplies the content; where moderation is enabled, execution begins after a moderator approves the comment and a visitor opens the affected page.

W3 Total Cache before 2.10.5 does not validate the request path used to construct cache-file names. An unauthenticated attacker can write into any existing server directory and overwrite the target name; on Apache the flaw can overwrite .htaccess, break the site and remove hardening rules.

W3 Total Cache through 2.10.3 permits an unauthenticated commenter to store a malicious Comment Author Name that can execute when Lazy Load Images is enabled. UserExperience_LazyLoad_Mutator::tag_img_content_replace() used regular-expression replacements that could treat src= text inside a quoted attribute as a real image attribute and re-emit crafted author content unsafely during lazy-load rewriting. The payload executes when a visitor, including an administrator, views the affected page. Version 2.10.4 restricts replacements to top-level quoted attributes and protects intermediate content with an encoded placeholder. The exact reporter payload is not disclosed.

W3 Total Cache 2.10.2 and earlier permits unauthenticated path traversal. Attacker-controlled path data reaches a filesystem operation without adequate restriction, but.

W3 Total Cache is affected by filesystem traversal. The vulnerable path is reachable without authentication. A crafted path can escape the intended directory and reach files or directories elsewhere on the server. The published affected range is <= 2.9.4.

W3 Total Cache is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is n/a through 2.9.4.

W3 Total Cache is affected by broken access control. Exploitation requires an authenticated author account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 2.9.1.

W3 Total Cache is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is <= 2.9.3.

W3 Total Cache is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

W3 Total Cache is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

W3 Total Cache is affected by sensitive information exposure. Exploitation requires an authenticated subscriber account. Successful exploitation can disclose data that should not be available to the caller.

W3 Total Cache is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

W3 Total Cache is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

W3 Total Cache is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.

W3 Total Cache is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

W3 Total Cache is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

W3 Total Cache is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

W3 Total Cache is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

W3 Total Cache is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

W3 Total Cache is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

W3 Total Cache is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

W3 Total Cache is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

W3 Total Cache is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.