CVE-2026-5032

High

Published: 02 April 2026

Published

02 April 2026

Modified

27 April 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0006 19.8th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-5032 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AU-13 (Monitoring for Information Disclosure) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Flaw remediation requires timely patching of the W3 Total Cache plugin to versions beyond 2.9.3, directly eliminating the information exposure and subsequent RCE vulnerability.

AU-13 Monitoring for Information Disclosure good match

detect

Monitoring for information disclosure directly detects unauthorized exposure of the W3TC_DYNAMIC_SECURITY token in page source triggered by crafted User-Agent headers.

SI-10 Information Input Validation good match

prevent

Information input validation on HTTP headers like User-Agent prevents the bypass of the output buffering pipeline that exposes sensitive dynamic fragment tokens.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

Why these techniques?

Vulnerability in public-facing WordPress plugin enables unauthenticated exploitation via crafted HTTP requests for initial access (T1190) and results in arbitrary PHP code execution on the server (T1059).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

The W3 Total Cache plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 2.9.3. This is due to the plugin bypassing its entire output buffering and processing pipeline when the request's User-Agent header contains…

"W3 Total Cache", which causes raw mfunc/mclude dynamic fragment HTML comments — including the W3TC_DYNAMIC_SECURITY security token — to be rendered in the page source. This makes it possible for unauthenticated attackers to discover the value of the W3TC_DYNAMIC_SECURITY constant by sending a crafted User-Agent header to any page that contains developer-placed dynamic fragment tags, granted the site has the fragment caching feature enabled. With the leaked W3TC_DYNAMIC_SECURITY token, an attacker can craft valid mfunc tags to execute arbitrary PHP code on the server, achieving remote code execution.

Deeper analysisAI

CVE-2026-5032 is an information exposure vulnerability (CWE-200) affecting the W3 Total Cache plugin for WordPress in all versions up to and including 2.9.3. The issue arises because the plugin bypasses its entire output buffering and processing pipeline when the request's User-Agent header contains "W3 Total Cache". This causes raw mfunc/mclude dynamic fragment HTML comments—including the W3TC_DYNAMIC_SECURITY security token—to be rendered in the page source on any page containing developer-placed dynamic fragment tags, provided the site's fragment caching feature is enabled.

Unauthenticated attackers can exploit this vulnerability by sending a crafted HTTP request with the specified User-Agent header to a targeted page. This leaks the W3TC_DYNAMIC_SECURITY token from the HTML source. Armed with the token, attackers can then craft valid mfunc tags to execute arbitrary PHP code on the server, resulting in remote code execution. The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Advisories point to the vulnerable code in Generic_Plugin.php at line 1016 (https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.9.3/Generic_Plugin.php#L1016) and a fix applied in changeset 3495959 (https://plugins.trac.wordpress.org/changeset/3495959/w3-total-cache). Additional details are available in Wordfence threat intelligence (https://www.wordfence.com/threat-intel/vulnerabilities/id/a65eb62d-847b-4f3a-848b-1290e3118c01?source=cve). Mitigation involves updating the plugin to a version beyond 2.9.3.