W3 Total Cache plugin flaw exposes 1 million WordPress sites to attacks

A severe flaw in the W3 Total Cache plugin installed on more than one million WordPress sites could give attackers access to various information, including metadata on cloud-based apps.

The W3 Total Cache plugin uses multiple caching techniques to optimize a website's speed, reduce load times, and generally improve its SEO ranking.

The flaw is tracked as CVE-2024-12365 despite the developer releasing a fix in the latest version of the product, hundreds of thousands of websites have still to install the patched variant.

Vulnerability details

Wordfence notes that the security issue is due to a missing capability check in the ‘is_w3tc_admin_page’ function in all versions up to the latest one, 2.8.2. This fault allows access to the plugin's security nonce value and perform unauthorized actions.

Exploiting the vulnerability is possible if the attacker is authenticated and has at least subscriber-level, a condition that is easily met.

The main risks that arise from the exploitation of CVE-2024-12365 are:

• Server-Side Request Forgery (SSRF): make web requests that could potentially expose sensitive data, including instance metadata on cloud-based apps
• Information disclosure
• Service abuse: consume cache service limits, which impact site performance and can generate increased costs

Regarding the real-world impact of this flaw, attackers could use the website’s infrastructure to proxy requests to other services and use the collected information to stage further attacks.

The best action for impacted users is to take is to upgrade to the latest version of W3 Total Cache version, 2.8.2, which addresses the vulnerability.

Download statistics from wordpress.org indicate that roughly 150,000 websites installed the plugin after the developer released the most recent update, leaving hundreds of thousands of WordPress sites still vulnerable.

As a general recommendations, website owners should avoid installing too many plugins and discard the products that are not absolutely necessary.

Additionally, a web application firewall could prove beneficial as it could identify and block exploitation attempts.