Remote Code Execution via mfunc Sanitizer Bypass in W3 Total Cache Fragment Cache

W3 Total Cache up to 2.9.1 removes mfunc/mclude dynamic-fragment tags from comments and other user content with a pattern that misses tags written without a space after the keyword, and a crafted tag is reassembled into a valid one when the security token is stripped. An unauthenticated attacker who knows the site's W3TC_DYNAMIC_SECURITY token can... Weiterlesen: Remote Code Execution via mfunc Sanitizer Bypass in W3 Total Cache Fr…