CVE-2013-2010: WordPress W3 Total Cache Plugin Remote PHP Code Execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network exploitability, no authentication, and public exploit code make this a critical risk for any unpatched WordPress site running the affected plugin version.

What it is

The WordPress W3 Total Cache plugin version 0.9.2.8 contains an injection flaw (CWE-74) that allows remote PHP code execution. The vulnerability is network-reachable with no authentication or user interaction required, and public exploit code exists. It matters because successful exploitation gives full control of the affected WordPress site.

Impact

An unauthenticated remote attacker can execute arbitrary PHP code on the server, leading to full site compromise, data theft, and potential lateral movement within the hosting environment.

Attack surface

The flaw is reachable over the network via the WordPress plugin's exposed functionality, as indicated by the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication or user interaction is required.

Exploitation

Public exploit code is available (Exploit-DB, Packet Storm), and EPSS indicates a high probability of exploitation (0.73862, 99.45th percentile), though the CVE is not listed in CISA KEV.

What to do

• Update the W3 Total Cache plugin to a version later than 0.9.2.8 immediately.
• If patching is not possible, disable or remove the plugin until an update can be applied.
• Restrict access to WordPress administrative and plugin endpoints using network controls or a web application firewall.
• Monitor for unexpected PHP file creation or modification in the WordPress installation.
• Apply the principle of least privilege to the web server user to limit post-exploitation impact.

Detection

• Inspect web server logs for requests to W3 Total Cache plugin paths with suspicious parameters or payloads.
• Monitor for anomalous PHP processes or outbound connections originating from the web server.
• Use file integrity monitoring to detect unauthorized changes to WordPress core, plugin, or theme files.
• Search for known exploit signatures associated with CVE-2013-2010 in network traffic or host-based logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.