Description
The W3 Total Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.5 via Google OAuth API secrets stored in plaintext in the publicly visible plugin source. This can allow unauthenticated attackers to impersonate W3 Total Cache and gain access to user account information in successful conditions. This would not impact the WordPress users site in any way.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| boldgrid | W3 Total Cache | ≤ 2.7.5 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
enzocipher/CVE-2023-5359 ★ 0 · Nov 7, 2025
CVE-2023-5359 - W3 Total Cache Cleartext Storage Vulnerability Scanner. Detect exposed credentials in W3 Total Cache plugin versions ≤ 2.7.5.
-
spyata123/Cleartext-Storage-vulnerability-CVE-2023-5359-in-W3-Total-Cache ★ 0 · Mar 11, 2025
Targets versions ≤2.7.5 vulnerable to CVE-2023-5359
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.