CVE-2025-9501: W3 Total Cache < 2.8.13 - Unauthenticated Command Injection
Published Nov 17, 2025
·Updated
The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the parsedynamicmfunc function, allowing unauthenticated users to execute PHP commands by submitting a comment with a malicious payload to a post.
Affected Software
1 affected component
W3 Total Cache<2.8.13
Event History
Nov 17, 2025
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverity
Nov 19, 2025
News Published
via BleepingComputer·05:34 PM
News Published
via BleepingComputer·05:35 PM
Feb 20, 57937
Event
via FIRST·05:22 PM
Frequently Asked Questions
1
What is the severity of CVE-2025-9501?
CVE-2025-9501 has been rated as a high severity vulnerability due to its ability to allow unauthenticated command injection.
2
How do I fix CVE-2025-9501?
The vulnerability can be fixed by updating the W3 Total Cache plugin to version 2.8.13 or later.
3
Who is affected by CVE-2025-9501?
All users of the W3 Total Cache WordPress plugin versions prior to 2.8.13 are affected by CVE-2025-9501.
4
What type of vulnerability is CVE-2025-9501?
CVE-2025-9501 is classified as a command injection vulnerability.
5
Can CVE-2025-9501 be exploited remotely?
Yes, CVE-2025-9501 can be exploited remotely by unauthenticated users through malicious comments.