W3 Total Cache plugin flaw exposes 1 million WordPress sites to attacks

A critical vulnerability (CVE-2024-12365) in the W3 Total Cache WordPress plugin—caused by a missing capability check in the is_w3tc_admin_page function—allows authenticated users with subscriber-level access to perform SSRF and access sensitive information (including cloud instance metadata), potentially enabling further attacks; the developer fixed the issue in version 2.8.2, but hundreds of thousands of sites remain unpatched, so site owners are advised to update immediately and consider web application firewalls.