CVE-2026-27384: 
WordPress vulnerability analysis and mitigation

CVE-2026-27384 is an Improper Validation of Specified Quantity in Input vulnerability (CWE-1284) in the BoldGrid W3 Total Cache WordPress plugin that allows unauthenticated network attackers to access functionality not properly constrained by ACLs. It affects W3 Total Cache versions up to and including 2.9.1. The vulnerability was published on March 5, 2026, and was assigned by Patchstack. It carries a CVSS v3.1 base score of 9.0 (Critical) (Feedly, EUVD).

The root cause is classified as CWE-1284 (Improper Validation of Specified Quantity in Input), which enables attackers to bypass access control lists (ACLs) and reach restricted administrative functionality within the plugin. The attack vector is network-based, requires no authentication or user interaction, but does require high attack complexity. The vulnerability is categorized as enabling "Accessing Functionality Not Properly Constrained by ACLs," suggesting that insufficient input quantity validation allows requests to circumvent permission checks and invoke privileged plugin operations (Feedly, Patchstack).

Successful exploitation can result in unauthorized access to sensitive administrative features of the W3 Total Cache plugin, with high impact to confidentiality, integrity, and availability. Attackers could disclose sensitive configuration data, modify caching or plugin settings, or disrupt site availability. The vulnerability has a changed scope, meaning exploitation could affect resources beyond the plugin itself, potentially impacting the broader WordPress installation and hosted data (Feedly).

As of the time of reporting, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.037%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

The primary remediation is to upgrade the W3 Total Cache plugin beyond version 2.9.1 to a patched release as soon as one becomes available from BoldGrid. In the interim, administrators should monitor the official WordPress plugin repository and Patchstack advisories for patch availability. As a temporary workaround, consider implementing network-level access controls to restrict access to the plugin's administrative interfaces, or temporarily disabling the plugin if the risk is deemed unacceptable. Audit systems running affected versions for any signs of unauthorized access or configuration changes (Feedly, Patchstack).

Wordfence included this vulnerability in their weekly WordPress vulnerability report covering February 23 – March 1, 2026, highlighting it as a notable issue for WordPress site administrators (Wordfence). Sucuri also referenced the vulnerability in their March 2026 vulnerability patch roundup (Sucuri). Liquid Web noted a related incident on their status page, suggesting some hosting providers were actively tracking the issue (Liquid Web).