CVE-2026-27384
Improper Input Validation in W3 Total Cache Enables Unauthorized Access
Publication date: 2026-03-05
Last updated on: 2026-03-09
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| boldgrid | w3_total_cache | to 2.9.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1284 | The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-27384 is an Arbitrary Code Execution vulnerability in the WordPress W3 Total Cache plugin, affecting versions up to and including 2.9.1.
The vulnerability arises from improper validation of specified quantity in input, allowing an unauthenticated attacker to remotely execute malicious code on a vulnerable site.
It falls under the OWASP Top 10 category A3: Injection.
How can this vulnerability impact me? :
This vulnerability allows an unauthenticated attacker to remotely execute arbitrary malicious code on your WordPress site if you are using the vulnerable W3 Total Cache plugin version.
Such an attack can compromise the integrity, confidentiality, and availability of your website and its data.
Despite the high CVSS score of 9 indicating severe potential impact, the issue is considered low priority by Patchstack due to its low severity impact and the unlikelihood of exploitation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There is no specific detection method or commands provided for identifying this vulnerability on your network or system.
What immediate steps should I take to mitigate this vulnerability?
Since no official patch is currently available for this vulnerability, users are advised to monitor for updates and apply mitigations as provided by security services like Patchstack.