CVE-2025-9501
CRITICAL
Published Nov 17, 2025
Modified Apr 15, 2026
Description
The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the _parse_dynamic_mfunc function, allowing unauthenticated users to execute PHP commands by submitting a comment with a malicious payload to a post.
CVSS v3.1 Score
9.0
CRITICAL
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
References
Frequently Asked Questions
What is CVE-2025-9501? +
The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the _parse_dynamic_mfunc function, allowing unauthenticated users to execute PHP commands by submitting a comment with a malicious payload to a post. It has a CVSS v3.1 base score of 9.0 (CRITICAL).
How severe is CVE-2025-9501? +
CVE-2025-9501 has a CVSS v3.1 score of 9.0 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately.
How do I check if I'm vulnerable to CVE-2025-9501? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.