CVE-2023-5359: The W3 Total Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.5 via Google OAuth API secrets…

PriorityP346high7.5CVSS 3.1

AVNACLPRNUINSUCHINAN

EPSS

0.80%

52.0th percentile

The W3 Total Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.5 via Google OAuth API secrets stored in plaintext in the publicly visible plugin source. This can allow unauthenticated attackers to impersonate W3 Total Cache and gain access to user account information in successful conditions. This would not impact the WordPress users site in any way.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
boldgrid	w3_total_cache	< 2.7.6	2.7.6
boldgrid	w3_total_cache	<= 2.7.5	—
msrc	microsoft_edge	—	—
msrc	microsoft_edge_extended_stable	—	—

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vendor_msrc8.8HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.