{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/w3-total-cache--2.7.6/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2023-5359"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["W3 Total Cache (\u003c 2.7.6)"],"_cs_severities":["high"],"_cs_tags":["wordpress","vulnerability","credential-exposure","web-application"],"_cs_type":"advisory","_cs_vendors":["Boldgrid"],"content_html":"\u003cp\u003eCVE-2023-5359 affects the WordPress plugin W3 Total Cache (versions ≤ 2.7.5). The plugin stores sensitive configuration and API credentials in plain text within PHP files located in the \u003ccode\u003e/wp-content/plugins/w3-total-cache/\u003c/code\u003e directory. Due to insufficient access control, these files are directly accessible via standard HTTP GET requests, leading to the exposure of CloudFlare API keys, client secrets, and other third-party service credentials.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to obtain sensitive credentials. This may result in the takeover of associated services (e.g., CloudFlare DNS and CDN management), unauthorized access to external service accounts via compromised OAuth tokens, and potential manipulation of cached website content.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the W3 Total Cache plugin to version 2.7.6 or later immediately.\u003c/li\u003e\n\u003cli\u003eRevoke and regenerate all API keys, OAuth tokens, and client secrets associated with the affected WordPress installation.\u003c/li\u003e\n\u003cli\u003eImplement access restrictions in the web server configuration (e.g., .htaccess for Apache) to deny direct access to PHP files within the plugin directory, while explicitly allowing access only to required entry points like 'w3-total-cache.php'.\u003c/li\u003e\n\u003cli\u003eConduct an audit of logs for unauthorized HTTP GET requests directed at the \u003ccode\u003e/wp-content/plugins/w3-total-cache/\u003c/code\u003e path to determine if exploitation has occurred.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T15:00:35Z","date_published":"2026-10-22T15:00:35Z","id":"https://feed.craftedsignal.io/briefs/2026-10-w3-total-cache-exposure/","summary":"CVE-2023-5359 is a cleartext credential storage vulnerability in W3 Total Cache versions 2.7.5 and earlier that allows unauthenticated remote attackers to retrieve API keys and OAuth secrets via direct HTTP requests to plugin PHP files.","title":"Boldgrid W3 Total Cache Cleartext Credential Storage (CVE-2023-5359)","url":"https://feed.craftedsignal.io/briefs/2026-10-w3-total-cache-exposure/"}],"language":"en","title":"CraftedSignal Threat Feed - W3 Total Cache (\u003c 2.7.6)","version":"https://jsonfeed.org/version/1.1"}