WordPress Plugin: w3-total-cache: CVE-2025-9501: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The W3 Total Cache plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.8.12 via _parse_dynamic_mfunc . This makes it possible for unauthenticated attackers to execute code on the server when comments are enabled and a post has been incorrectly injected with the mfunc tags. Please note we consider this to be a theoretical issue, and as such we rejected the original report from the researcher who then submitted this to WPScan. WPScan assigned a CVE ID, but we do not agree that this is a true security vulnerability. Exploitation of this issue is theoretical and requires gaining access to a secret value much like gaining access to a password.