CVE-2025-9501

The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the _parse_dynamic_mfunc function, allowing unauthenticated users to execute PHP commands by submitting a comment with a malicious payload to a post.

CVSS v3.1

9.0 CRITICALCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

20.47% chance of exploitation in the next 30 days, 97th percentile

Published

2025-11-17

Proof-of-concept exploits (2)

• https://wpscan.com/vulnerability/6697a2c9-63ae-42f0-8931-f2e5d67d45ae/
• InnerFireZ/CVE-2025_9501-POC

References

• CVE Record
• NVD entry

Related

• CVE-2025-9492
• CVE-2025-9502
• CVE-2025-9491
• CVE-2025-9503
• CVE-2025-9487
• CVE-2025-9504