CyberRota Analysis
This is a critical severity vulnerability with a CVSS score of 9.0. It affects WordPress. Its EPSS score suggests a 20.5% probability of exploitation in the next 30 days. Exploitation may require the attacker to be authenticated.
CVE
CVE-2025-9501
Severity
CRITICAL
CVSS
9
EPSS
20.47%
WordPress
Original NVD Description
The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the _parse_dynamic_mfunc function, allowing unauthenticated users to execute PHP commands by submitting a comment with a malicious payload to a post.