W3TC and WP Super Cache Vulnerability Discovered, We've Automatically Patched
Apr 25, 2013Matthew Prince
Summary
Cloudflare automatically applied a network rule to protect all accounts against a remote code execution vulnerability in W3 Total Cache (versions 0.9.2.8 and below) and WP Super Cache (versions 1.2 and below). The vulnerability, discovered by Sucuri, allows attackers to execute arbitrary PHP code on a server by exploiting functions like mfunc, mclude, and dynamic-cached-content. The post emphasizes the importance of immediate plugin upgrades despite the network-level protection.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack