WordPress Plugin Security Roundup: March 2026

Correction — updated July 29, 2026: This post originally stated that CVE-2026-27384 in W3 Total Cache had no vendor patch. That was wrong. BoldGrid fixed it in W3 Total Cache 2.9.2, released March 5, 2026 — before this post was published. We should have caught it, and we did not. If you disabled W3 Total Cache on our advice, you can safely re-enable it after updating to 2.9.2 or later (the current release is 2.10.3). We have corrected the affected sections below and left the rest of the post intact.

Every month we review the WordPress plugin vulnerability disclosures from Patchstack and WPScan and summarize the ones that matter most: high install counts, exploitable without privileges, or actively weaponized in the wild. March 2026 brought three critical disclosures, all of which now have fixes available.

March 2026 at a Glance

CVE	Plugin	Severity	Type	Auth Required	Status
CVE-2026-27384	W3 Total Cache	Critical	Arbitrary Code Execution	None	Patched — update to 2.9.2 or later
CVE-2026-23802	AI Engine	Critical	Arbitrary File Upload	None	Patched — update to 3.3.3
CVE-2026-1993	ExactMetrics	8.8 High	Privilege Escalation	Yes — low-privileged	Patched — update to 9.0.3

All three have fixes available: update W3 Total Cache to 2.9.2 or later, AI Engine to 3.3.3, and ExactMetrics to 9.0.3. If you run any of them, treat this as a same-day job rather than a maintenance-window one.

CVE-2026-27384 — W3 Total Cache (Critical)

Affected versions: All versions up to and including 2.9.1
Fixed in: 2.9.2, released March 5, 2026 (current release is 2.10.3)
Auth required to exploit: None — unauthenticated
Install count: 900,000+ active installations

W3 Total Cache is one of the oldest and most widely deployed WordPress caching plugins, with nearly one million active installations. CVE-2026-27384 is a critical arbitrary code execution vulnerability — meaning a remote attacker with no credentials can execute code on the server. It was reported by CODE WHITE GmbH and published by Patchstack on February 24, 2026.

The fix shipped in 2.9.2 on March 5, 2026, alongside patches for a broken access control issue in the Image Service AJAX handlers and an mfunc security flaw. Any site still running 2.9.1 or earlier is exposed to a vulnerability that has been public since February.

What to do:

Update to 2.9.2 or later. The current release is 2.10.3. This is the fix — everything below is for sites that cannot update immediately.
Apply a Web Application Firewall (WAF) rule if you cannot update right away. Sucuri, Cloudflare, and similar services can virtually patch known vulnerabilities by blocking exploit patterns at the network edge.
Disable W3 Total Cache temporarily if you can tolerate reduced performance and cannot update or virtual-patch. Deactivating removes the attack surface entirely.
Check your server logs for unusual POST requests to WordPress AJAX endpoints or unexpected PHP file creation, which can indicate exploitation attempts. Given how long this has been public, this is worth doing even after you update.

CVE-2026-23802 — AI Engine (Critical)

Affected versions: All versions up to and including 3.3.2
Fixed in: 3.3.3
Auth required to exploit: None — unauthenticated
Install count: 100,000+ active installations

AI Engine is a plugin that provides chatbot, content generation, and AI assistant features for WordPress sites, powered by OpenAI's API. CVE-2026-23802 is a critical arbitrary file upload vulnerability in the plugin's media handling component.

Missing file type validation in the upload handler allows an unauthenticated attacker to upload arbitrary files — including executable PHP scripts — to the server. Once uploaded, a PHP file becomes immediately executable via a direct URL request, giving the attacker full code execution on the server.

This is the same class of vulnerability that appears repeatedly in plugins that handle file uploads: the fix requires checking that uploaded files are of an allowed type and do not have executable extensions, rejecting anything that does not match. Version 3.3.3 implements this validation. Update immediately.

After updating, if you were running a vulnerable version, check your /wp-content/uploads/ directory and any upload folders used by AI Engine for PHP files that should not be there. Any .php file found in an uploads folder should be treated as a potential backdoor.

CVE-2026-1993 — ExactMetrics (CVSS 8.8 High)

Affected versions: 7.1.0 through 9.0.2
Fixed in: 9.0.3
Auth required to exploit: Yes — an authenticated user holding the exactmetrics_save_settings capability
Install count: 300,000+ active installations

ExactMetrics is a Google Analytics dashboard plugin for WordPress — one of several in this category. CVE-2026-1993 is an improper privilege management flaw that lets a delegated user quietly widen access far beyond what the site owner intended.

The mechanism is specific: the plugin's update_settings() function accepts arbitrary setting names without checking them against a whitelist. That includes save_settings, the option controlling which user roles can access plugin functionality. An attacker who already holds the exactmetrics_save_settings capability can add subscriber to that list, granting plugin administrative access to every subscriber on the site. The admin meant to delegate configuration to one trusted user; the flaw lets that user re-delegate it to everyone.

This needs a logged-in user with a specific capability, so it is a rung below a fully unauthenticated flaw — but on a membership or e-commerce site with open registration, the subscriber pool is effectively the public. Update to 9.0.3, then review which roles currently have plugin access and audit your user list for unexpected privilege grants.

What to Do

W3 Total Cache: Update to 2.9.2 or later (current release 2.10.3). If you cannot update immediately, apply a WAF virtual patch or deactivate the plugin.
AI Engine: Update to 3.3.3. Check your uploads directory for unexpected PHP files. Treat any found as a potential backdoor.
ExactMetrics: Update to 9.0.3, then review which user roles have plugin access and audit your user list for unexpected privilege grants.

If you manage multiple WordPress sites, the real lesson from March is the gap between "a patch exists" and "you know a patch exists." The W3 Total Cache fix shipped weeks before most people running it heard about the vulnerability — monitoring the disclosure feeds is what closes that gap.

Looking Ahead

March 2026 reinforces a recurring theme: arbitrary file upload vulnerabilities continue to appear in plugins that handle user-supplied media or documents. The pattern is consistent and the fix is well-understood — yet implementation failures persist. Any plugin that accepts file uploads should be treated as higher risk and monitored more closely in vulnerability databases.

We will publish the April 2026 roundup at the end of next month. In the meantime, the Patchstack database is updated daily and is free to search.