CVE-2026-27384

WordPress W3 Total Cache plugin <= 2.9.1 - Arbitrary Code Execution vulnerability

9.0 CriticalPublic exploit

CVE-2026-27384 is a critical vulnerability (CVSS 9.0) in Boldgrid W3 Total Cache, published March 5, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 29th percentile. No source names a fixed version.

Improper Validation of Specified Quantity in Input vulnerability in BoldGrid W3 Total Cache w3-total-cache allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects W3 Total Cache: from n/a through <= 2.9.1.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.36%Up 0.3 points since Mar 5, 2026

What each source reports

CVE List Score used 9.0

WordPress W3 Total Cache plugin <= 2.9.1 - Arbitrary Code Execution vulnerability

Record: CVE-2026-27384
CVSS 3.1: 9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-1284
Updated: 2026-11-02

EUVDEUVD-2026-9637 9.0

Record: EUVD-2026-9637
CVSS 3.1: 9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-g2g2-5q7p-hmf2 9.0

Improper Validation of Specified Quantity in Input vulnerability in BoldGrid W3 Total Cache w3...

Record: GHSA-g2g2-5q7p-hmf2
CVSS 3.1: 9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-1284
Updated: 2026-11-02

NVD 9.0

Record: CVE-2026-27384
CVSS 3.1: 9.0 CriticalCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-1284
Updated: 2026-11-02

Affected products

boldgrid w3 total cache

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	xxconi/CVE-2026-27384	2026-05-26

History

History
When	Changed	Sources
2026-11-02	created	CVE List, EUVD, GitHub Advisories, NVD, PoC in GitHub