CVE-2026-57623

CriticalCVSS 9.0/10Last modified Jul 2, 2026

Description

Unauthenticated Arbitrary Code Execution in W3 Total Cache <= 2.9.4 versions.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-1284

Affected software

No affected versions have been published.

Timeline

Published
Jul 2, 2026
Last modified
Jul 2, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-5762410.0Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions.CVE-2026-576259.6Unauthenticated Cross Site Scripting (XSS) in Admin and Site Enhancements (ASE) Pro <= 8.8.5 versions.CVE-2026-576267.1Cross-Site Request Forgery (CSRF) vulnerability in MailPoet allows Cross Site Request Forgery. This issue affects MailPoet: from 5.30.0 thrCVE-2026-576274.9Subscriber Server Side Request Forgery (SSRF) in Kirki <= 6.0.11 versions.CVE-2026-576287.6Administrator SQL Injection in WP All Import <= 4.0.1 versions.CVE-2026-576296.5Contributor Cross Site Scripting (XSS) in StatCounter <= 2.1.1 versions.CVE-2026-576305.3Unauthenticated Insecure Direct Object References (IDOR) in Blocksy Companion Pro <= 2.1.46 versions.CVE-2026-576317.6Administrator SQL Injection in Popup box <= 6.0.1 versions.CVE-2026-576325.4Subscriber Broken Access Control in Email Marketing for WooCommerce by Omnisend <= 1.19.0 versions.CVE-2026-576335.3Unauthenticated Sensitive Data Exposure in WCBoost &#8211; Products Compare <= 1.1.0 versions.CVE-2026-576344.3Contributor Insecure Direct Object References (IDOR) in PPWP <= 1.9.19 versions.CVE-2026-576356.5Unauthenticated Cross Site Request Forgery (CSRF) in FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3 versions.
CVE-2026-57623: Critical severity, CVSS 9.0 | Vulnix