
- W3 Total Cache plugin flaw CVE-2025-9501 enables unauthenticated PHP command injection
- Affects all versions before 2.8.13; ~327,000+ sites remain at risk
- WPScan PoC exploit set for Nov 24, raising mass exploitation concerns
W3 Total Cache (W3TC), a WordPress plugin with more than a million users, carries a critical-severity vulnerability that allows threat actors to fully take over compromised websites, experts have warned.