Skip to content
Threat Feed
Subscribe
high advisory

Boldgrid W3 Total Cache Cleartext Credential Storage (CVE-2023-5359)

CVE-2023-5359 is a cleartext credential storage vulnerability in W3 Total Cache versions 2.7.5 and earlier that allows unauthenticated remote attackers to retrieve API keys and OAuth secrets via direct HTTP requests to plugin PHP files.

CVE search metadata

CVE search record: CVE-2023-5359. KEV: no. Product: W3 Total Cache (< 2.7.6). Brief: Boldgrid W3 Total Cache Cleartext Credential Storage (CVE-2023-5359). Brief link: https://feed.craftedsignal.io/briefs/2026-10-w3-total-cache-exposure/

Triage facts

Revision 1
Applicability
W3 Total Cache (< 2.7.6)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
2 public sources
Freshness
Revision 1Oct 22, 15:00 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
B2Very likely

CVE-2023-5359 affects the WordPress plugin W3 Total Cache (versions ≤ 2.7.5). The plugin stores sensitive configuration and API credentials in plain text within PHP files located in the /wp-content/plugins/w3-total-cache/ directory. Due to insufficient access control, these files are directly accessible via standard HTTP GET requests, leading to the exposure of CloudFlare API keys, client secrets, and other third-party service credentials.

Impact

Successful exploitation allows unauthenticated remote attackers to obtain sensitive credentials. This may result in the takeover of associated services (e.g., CloudFlare DNS and CDN management), unauthorized access to external service accounts via compromised OAuth tokens, and potential manipulation of cached website content.

Recommendation

  • Update the W3 Total Cache plugin to version 2.7.6 or later immediately.
  • Revoke and regenerate all API keys, OAuth tokens, and client secrets associated with the affected WordPress installation.
  • Implement access restrictions in the web server configuration (e.g., .htaccess for Apache) to deny direct access to PHP files within the plugin directory, while explicitly allowing access only to required entry points like 'w3-total-cache.php'.
  • Conduct an audit of logs for unauthorized HTTP GET requests directed at the /wp-content/plugins/w3-total-cache/ path to determine if exploitation has occurred.

Immediate actions

Patch W3 Total Cache to version 2.7.6 or later

IT Operations 24h

Deploy webserver detection rule for unauthorized access to plugin PHP files

Detection Engineering 48h

Mitigations

Restrict access to plugin PHP files via server configuration

immediate IT Operations

CVE-2023-5359

Detection coverage 1

Detect CVE-2023-5359 Exploitation Attempts - Unauthorized Access to W3 Total Cache Config Files

high

Detects unauthorized HTTP GET requests to known sensitive PHP files within the W3 Total Cache plugin directory.

sigma tactics: credential_access techniques: T1552.001 sources: webserver

Detection queries are available on the platform. Get full rules →