CVE-2026-57623

WordPress W3 Total Cache plugin <= 2.9.4 - Arbitrary Code Execution vulnerability

Unauthenticated Arbitrary Code Execution in W3 Total Cache <= 2.9.4 versions.

We have discovered 22,850 live websites that are affected by CVE-2026-57623.

Run a Free Instant Scan



Affected Software

Product  W3 Total Cache
Category Cache Tools
Vulnerable Domains22,850 live websites (100% of W3 Total Cache install base)
Vulnerable Versions
  • from 0 through 2.9.4
Vulnerable Versions Count110 versions ( 100% of all versions)


Common Weakness Enumeration

CWE-1284 Improper Validation of Specified Quantity in Input



Details

  • Published - Jul 2, 2026
  • Updated - Jul 2, 2026

Credits

  • Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program (finder)

Website Distribution by Country

Number of websites using CVE-2026-57623
United States8,638 websites


Germany2,729 websites
GB927 websites
Italy862 websites
France852 websites
Netherlands831 websites
Canada681 websites
Slovakia621 websites
Australia452 websites
Poland432 websites

Website Distribution by TLD

Number of websites using CVE-2026-57623
.com10,669 websites
.de1,757 websites
.nl685 websites
.org676 websites
.it640 websites
.net585 websites
.co.uk577 websites
.ca462 websites
.com.au406 websites
.pl340 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-57623

Top websites that are affected by CVE-2026-57623. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***********.eu Cyprus*,***
*********.com United States*,***
*********.com United States*,***
**********.com United States*,***
**********.com United States**,***
********.com Germany**,***
********.com United States**,***
***.org Germany**,***
************.com United States**,***
*********.com Indonesia**,***
See full domain list

FAQ

CVE-2026-57623 is Improper Validation of Specified Quantity in Input in W3 Total Cache
A total of 22,850 websites have been identified as vulnerable to CVE-2026-57623, based on global website indexing conducted by WebTechSurvey.
The W3 Total Cache is affected by the CVE-2026-57623 vulnerability.
W3 Total Cache versions up to and including 2.9.4 are vulnerable to CVE-2026-57623.