A severe flaw in the W3 Total Cache plugin installed on more than one million WordPress sites could give attackers access to various information, including metadata on cloud-based apps.
The W3 Total Cache plugin uses multiple caching techniques to optimize a website's speed, reduce load times, and generally improve its SEO ranking.
The flaw is tracked as CVE-2024-12365 despite the developer releasing a fix in the latest version of the product, hundreds of thousands of websites have still to install the patched variant.
Vulnerability details
Wordfence notes that the security issue is due to a missing capability check in the ‘is_w3tc_admin_page’ function in all versions up to the latest one, 2.8.2. This fault allows access to the plugin's security nonce value and perform unauthorized actions.
Exploiting the vulnerability is possible if the attacker is authenticated and has at least subscriber-level, a condition that is easily met.
The main risks that arise from the exploitation of CVE-2024-12365 are:
- Server-Side Request Forgery (SSRF): make web requests that could potentially expose sensitive data, including instance metadata on cloud-based apps
- Information disclosure
- Service abuse: consume cache service limits, which impact site performance and can generate increased costs
Regarding the real-world impact of this flaw, attackers could use the website’s infrastructure to proxy requests to other services and use the collected information to stage further attacks.
The best action for impacted users is to take is to upgrade to the latest version of W3 Total Cache version, 2.8.2, which addresses the vulnerability.
Download statistics from wordpress.org indicate that roughly 150,000 websites installed the plugin after the developer released the most recent update, leaving hundreds of thousands of WordPress sites still vulnerable.
As a general recommendations, website owners should avoid installing too many plugins and discard the products that are not absolutely necessary.
Additionally, a web application firewall could prove beneficial as it could identify and block exploitation attempts.
Top 10 MITRE ATT&CK© Techniques Behind 93% of Attacks
Based on an analysis of 14M malicious actions, discover the top 10 MITRE ATT&CK techniques behind 93% of attacks and how to defend against them.
Comments
PluginVulns - 3 months ago
Most WordPress websites don’t have open registration, so they claim that having a subscriber-level account is “a condition that is easily met” is not true. The number of websites exposed is also likely to be significantly less than the number of websites using the plugin.
A server-side request forgery vulnerability could be exploited in a targeted attack on a WordPress website, but isn’t something you would expect to be exploited more generally.
So calling this a severe flaw seems to be overstating the situation quite a bit.
If you are going to cover minor security issues with 1+ million WordPress plugins, today we ran across one that has been using an outdated and known insecure library for nearly 3 years: https://www.pluginvulnerabilities.com/2025/01/16/1-million-install-wordpress-plugin-has-been-using-an-outdated-known-insecure-version-of-a-library-for-nearly-3-years/