CVE-2025-9501
published 2025-11-17CVE-2025-9501: The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the _parse_dynamic_mfunc function, allowing unauthenticated users to…
PriorityP189critical9CVSS 3.1
AVNACHPRNUINSCCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
19.24%
97.0th percentile
The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the _parse_dynamic_mfunc function, allowing unauthenticated users to execute PHP commands by submitting a comment with a malicious payload to a post.
Detection & IOCsextracted from sources · hover to see the quote
bytes
<!-- mfunc ... <!-- /mfunc
- →Exploit payload is delivered via HTTP POST to a WordPress post comment endpoint; the malicious comment body contains the W3TC dynamic function markers `<!-- mfunc` and `<!-- /mfunc` wrapping injected PHP code. Detect by inspecting POST request bodies for both strings.
- →The vulnerability is triggered through the `_parse_dynamic_mfunc` function in W3 Total Cache versions prior to 2.8.13. Alert on PHP execution originating from comment-processing code paths in W3TC. ↗
- →PCPJack worm exploits CVE-2025-9501 as one of five CVEs for propagation. Look for the worm's on-disk artifacts: `/var/lib/.spm/` directory, files named `monitor.py`, `_lat.py`, `_cu.py`, `_cr.py`, `_csc.py`, `utils.py`, and the persistence service `sys-monitor.service`. ↗
- →PCPJack exfiltrates credentials to Telegram C2; each encrypted chunk is prepended with a 🔒 emoji after base64 encoding. Monitor outbound Telegram API traffic from server workloads for anomalous credential-shaped payloads. ↗
- →The PCPJack bootstrap script removes itself after execution (`rm -f "$0"`). Detect via process auditing (auditd/eBPF) for shell scripts that self-delete immediately after spawning Python virtual environments. ↗
- →The second PCPJack toolset drops Sliver ELF backdoor binaries named `update.bin`, `update-386.bin`, and `update-arm.bin` to `/var/tmp/apt-daily-upgrade`. Alert on ELF binaries written to `/var/tmp/` with these filenames. ↗
- →PCPJack scans MongoDB on port 27017 as part of lateral movement and external propagation. Unexpected outbound connections to port 27017 from web-tier hosts may indicate active worm propagation. ↗
- →The W3TC secret key (`W3TC Cache Secret`) is specifically targeted by the PCPJack credential extractor (`utils.py`). If this value is found in exfiltrated data or logs, it confirms W3TC exploitation in the environment. ↗
- ·The Emerging Threats Snort rule (sid:2065928) is marked `confidence Medium` and requires TLS decryption (`deployment SSLDecrypt`, `tls_state TLSDecrypt`) to fire on HTTPS WordPress traffic. Without SSL inspection, the rule will not detect encrypted exploit attempts.
- ·If the `cryptography` Python library is not installed in the victim environment, PCPJack silently falls back to sending credentials in plaintext, meaning DLP/network monitoring may catch unencrypted exfiltration even without decrypting Telegram traffic. ↗
CVSS provenance
nvdv3.19.0CRITICALCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
vulncheck9.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-wx46-pc78-pqhq: The W3 Total Cache WordPress plugin before 2
ghsa_unreviewed·2025-11-17
CVE-2025-9501 [CRITICAL] GHSA-wx46-pc78-pqhq: The W3 Total Cache WordPress plugin before 2
The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the _parse_dynamic_mfunc function, allowing unauthenticated users to execute PHP commands by submitting a comment with a malicious payload to a post.
VulnCheck
W3 Total Cache '_parse_dynamic_mfunc' Command Injection
vulncheck·2025·CVSS 9.0
CVE-2025-9501 [CRITICAL] W3 Total Cache '_parse_dynamic_mfunc' Command Injection
W3 Total Cache '_parse_dynamic_mfunc' Command Injection
The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the _parse_dynamic_mfunc function, allowing unauthenticated users to execute PHP commands by submitting a comment with a malicious payload to a post.
Affected: Unknown W3 Total Cache
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.sentinelone.com/labs/cloud-worm-evicts-teampcp-and-steals-credentials-at-scale/
Exploit PoC: https://vulncheck.com/xdb/764f6cd2dc8f
Suricata
ET WEB_SPECIFIC_APPS WordPress W3 Total Cache Plugin Remote Code Execution (CVE-2025-9501)
suricata·2025-11-26·CVSS 9.0
CVE-2025-9501 [CRITICAL] ET WEB_SPECIFIC_APPS WordPress W3 Total Cache Plugin Remote Code Execution (CVE-2025-9501)
ET WEB_SPECIFIC_APPS WordPress W3 Total Cache Plugin Remote Code Execution (CVE-2025-9501)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS WordPress W3 Total Cache Plugin Remote Code Execution (CVE-2025-9501)"; flow:established,to_server; http.request_body; content:"<!-- mfunc"; content:"<!-- /mfunc"; fast_pattern; distance:0; http.method; content:"POST"; reference:url,www.rcesecurity.com/2025/11/exploiting-a-pre-auth-rce-in-w3-total-cache-for-wordpress-cve-2025-9501/; reference:cve,2025-9501; classtype:web-application-attack; sid:2065928; rev:1; metadata:affected_product Wordpress_Plugins, attack_target Server, tls_state TLSDecrypt, created_at 2025_11_26, cve CVE_2025_9501, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence Medium, signature
No public exploits indexed.
Sans Isc
TeamPCP Supply Chain Campaign: Activity Through 2026-05-17, (Mon, May 18th)
blogs_sans_isc·2026-05-18
CVE-2026-45321 TeamPCP Supply Chain Campaign: Activity Through 2026-05-17, (Mon, May 18th)
TeamPCP Supply Chain Campaign: Activity Through 2026-05-17
Published: 2026-05-18. Last Updated: 2026-05-18 20:08:00 UTC
by Kenneth Hartman (Version: 1)
0 comment(s)
Since the last update, the TeamPCP supply chain campaign produced its loudest stretch since the March Trivy disclosure: an officially confirmed Checkmarx Jenkins plugin compromise and a new self-spreading Mini Shai-Hulud worm across npm and PyPI.
Bottom line up front
Two TeamPCP events broke within 48 hours of each other and doubled attention on the campaign. Checkmarx confirmed its Jenkins AST plugin was trojanized, its third compromise in three months, validating an earlier single-researcher claim. In parallel, a new Mini Shai-Hulud worm poisoned roughly 170 npm and PyPI packages (42 @tanstack packages in about six minut
Bleepingcomputer
New PCPJack worm steals credentials, cleans TeamPCP infections
blogs_bleepingcomputer·2026-05-07·CVSS 9.1
CVE-2025-29927 [CRITICAL] New PCPJack worm steals credentials, cleans TeamPCP infections
## New PCPJack worm steals credentials, cleans TeamPCP infections
## Bill Toulas
PCPJack’s capabilities revolve mainly around credential theft, targeting cloud environments, developer systems, messenger apps, financial services, databases, SSH keys, Slack tokens, WordPress configs, OpenAI keys, Anthropic keys, Discord, DigitalOcean, and more.
The credentials are exfiltrated to Telegram channels after they are encrypted using X25519 ECDH and ChaCha20-Poly1305, and split into 2800-byte chunks respecting Telegram’s message character limits.
PCPJack propagates by scanning external cloud infrastructure for exposed services such as Docker, Kubernetes, Redis, MongoDB, and RayML, then attempts exploiting known vulnerabilities to gain access.
It also downloads hostname data from Common Crawl p
Sentinelone
PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale
blogs_sentinelone·2026-05-07
CVE-2025-29927 PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale
## PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale
## Executive Summary
SentinelLABS has identified PCPJack, a credential theft framework that worms across exposed cloud infrastructure and removes artifacts associated with TeamPCP, a threat actor persona who claimed several high-profile supply chain intrusions throughout early 2026.
The toolset harvests credentials from cloud, container, developer, productivity, and financial services, then exfiltrates the data through attacker-controlled infrastructure while attempting to spread to additional hosts.
PCPJack targets exposed services including Docker, Kubernetes, Redis, MongoDB, RayML, and vulnerable web applications, enabling both external propagation and lateral movement inside victim environments.
Unlike typical
Hackernews
PCPJack Credential Stealer Exploits 5 CVEs to Spread Worm-Like Across Cloud Systems
blogs_hackernews·2026-05-07
CVE-2025-55182 PCPJack Credential Stealer Exploits 5 CVEs to Spread Worm-Like Across Cloud Systems
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## PCPJack Credential Stealer Exploits 5 CVEs to Spread Worm-Like Across Cloud Systems
Cybersecurity researchers have disclosed details of a new credential theft framework dubbed PCPJack that targets exposed cloud infrastructure and ousts any artifacts linked to TeamPCP from the environments.
"The toolset harvests credentials from cloud, container, developer, productivity, and financial services, then exfiltrates the data through attacker-controlled infrastructure while attempting to spread to additional hosts," SentinelOne security researcher Alex Delamotte said in a report published today.
PCPJack is specifically designed to
Dfir Report
Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting
blogs_dfir_report·2026-04-22·CVSS 10.0
CVE-2025-55182 [CRITICAL] Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting
OPENDIR
Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting
April 22, 2026
Table of Contents:
Summary
Secrets
Victims
Adversary
Capability
Defensive Recommendations
Notifications & Acknowledgments
Disclosure & Contact
Key Takeaways
We recently discovered an exposed server that was used for multi-victim exploitation, staging, review, and validation.
Claude Code and OpenClaw were used as an operator-side harness supporting exploitation activity and workflow orchestration.
We identified a large-scale React2Shell (CVE-2025-55182) operation that scanned millions of targets and confirmed 900+ successful exploits. Logs showed an automated pipeline for exploitation, hit scoring, alerting, and secret harvesting.
The threat actor exploited victims opportunistically at scal
Bleepingcomputer
W3 Total Cache WordPress plugin vulnerable to PHP command injection
blogs_bleepingcomputer·2025-11-19·CVSS 9.0
CVE-2025-9501 [CRITICAL] W3 Total Cache WordPress plugin vulnerable to PHP command injection
## W3 Total Cache WordPress plugin vulnerable to PHP command injection
## Bill Toulas
A critical flaw in the W3 Total Cache (W3TC) WordPress plugin can be exploited to run PHP commands on the server by posting a comment that contains a malicious payload.
The vulnerability, tracked as CVE-2025-9501 , affects all versions of the W3TC plugin prior to 2.8.13 and is described as an unauthenticated command injection.
W3TC is installed on more than one million websites to increase performance and reduce load times.
The developer released version 2.8.13, which addresses the security issue, on October 20. However, based on data from WordPress.org, hundreds of thousands of websites may still be vulnerable, as there have been around 430,000 downloads since the patch became available.
WordPress
2025-11-17
Published
Exploited in the wild