W3 Total Cache Plugin Bug Threatens Over 1 Million WordPress
A new vulnerability in the W3 Total Cache WordPress plugin, tracked as CVE-2025-9501, lets unauthenticated attackers run PHP commands on the server by posting crafted comments. Because W3TC powers more than a million sites, this command injection bug creates an attractive path to remote code execution and full site takeover. This article explains how the flaw works, which versions are affected, and how to respond quickly without breaking performance.