Every month we review the WordPress plugin vulnerability disclosures from Patchstack and WPScan and summarize the ones that matter most: high install counts, exploitable without privileges, or actively weaponized in the wild. March 2026 brought three critical disclosures — one with no vendor patch at time of writing.
March 2026 at a Glance
| CVE | Plugin | Severity | Type | Auth Required | Status |
|---|---|---|---|---|---|
| CVE-2026-27384 | W3 Total Cache | Critical | Arbitrary Code Execution | None | No fix available |
| CVE-2026-23802 | AI Engine | Critical | Arbitrary File Upload | None | Patched — update to 3.3.3 |
| CVE-2026-1993 | ExactMetrics | Critical | Privilege Escalation | None | Patched — update to 9.0.3 |
Update AI Engine and ExactMetrics immediately. For W3 Total Cache, read the mitigation steps in that section — a plugin update will not resolve the vulnerability until a vendor patch is available. Monitor the Patchstack database entry for CVE-2026-27384 for patch availability updates.
CVE-2026-27384 — W3 Total Cache (Critical — No Fix Available)
Affected versions: All versions through the current release at time of writing
Fixed in: No patch available as of March 31, 2026
Auth required to exploit: None — unauthenticated
Install count: 900,000+ active installations
W3 Total Cache is one of the oldest and most widely deployed WordPress caching plugins, with nearly one million active installations. CVE-2026-27384 is a critical arbitrary code execution vulnerability — meaning a remote attacker with no credentials can execute code on the server.
A patch was not available from the vendor as of this writing. This is the most difficult situation in plugin security: a critical vulnerability in a widely installed plugin where the standard advice — update the plugin — cannot yet be followed.
What you can do while waiting for a patch:
- Disable W3 Total Cache temporarily if your site can tolerate reduced performance. Deactivating the plugin removes the attack surface entirely until a patch is released. This is the most conservative option.
- Apply a Web Application Firewall (WAF) rule if you use a service that supports them. Sucuri, Cloudflare, and similar services can virtually patch known vulnerabilities by blocking exploit patterns at the network edge, even before a vendor patch exists.
- Monitor the Patchstack CVE entry for updates. When a patch is released, treat updating as the highest-priority task — do not wait for your regular maintenance window.
- Check your server logs for unusual POST requests to WordPress AJAX endpoints or unexpected PHP file creation, which can indicate active exploitation attempts.
We will update this post when a vendor patch becomes available. Check the Patchstack database or subscribe to their free email alerts for CVE-2026-27384.
CVE-2026-23802 — AI Engine (Critical)
Affected versions: All versions up to and including 3.3.2
Fixed in: 3.3.3
Auth required to exploit: None — unauthenticated
Install count: 100,000+ active installations
AI Engine is a plugin that provides chatbot, content generation, and AI assistant features for WordPress sites, powered by OpenAI's API. CVE-2026-23802 is a critical arbitrary file upload vulnerability in the plugin's media handling component.
Missing file type validation in the upload handler allows an unauthenticated attacker to upload arbitrary files — including executable PHP scripts — to the server. Once uploaded, a PHP file becomes immediately executable via a direct URL request, giving the attacker full code execution on the server.
This is the same class of vulnerability that appears repeatedly in plugins that handle file uploads: the fix requires checking that uploaded files are of an allowed type and do not have executable extensions, rejecting anything that does not match. Version 3.3.3 implements this validation. Update immediately.
After updating, if you were running a vulnerable version, check your /wp-content/uploads/ directory and any upload folders used by AI Engine for PHP files that should not be there. Any .php file found in an uploads folder should be treated as a potential backdoor.
CVE-2026-1993 — ExactMetrics (Critical)
Affected versions: All versions up to and including 9.0.2
Fixed in: 9.0.3
Auth required to exploit: None — unauthenticated
Install count: 300,000+ active installations
ExactMetrics is a Google Analytics dashboard plugin for WordPress — one of several in this category. CVE-2026-1993 is a critical privilege escalation vulnerability that allows an unauthenticated attacker to elevate their access to administrator level.
The mechanism mirrors the pattern seen in similar January and February disclosures this year: insufficient validation of role or capability parameters during an unauthenticated request path allows an attacker to assign themselves elevated privileges. In ExactMetrics's case, the vulnerability is in the plugin's onboarding or settings initialization flow — a code path that runs without authentication to allow first-time setup.
With 300,000+ installations and a fully unauthenticated escalation path, this is an immediate update. After updating to 9.0.3, check your WordPress user list for unfamiliar administrator accounts and rotate admin credentials as a precaution.
What to Do
- W3 Total Cache: Either disable the plugin temporarily while waiting for a patch, or apply a WAF virtual patch if your hosting or CDN supports it. Monitor Patchstack for patch availability.
- AI Engine: Update to 3.3.3. Check your uploads directory for unexpected PHP files. Treat any found as a potential backdoor.
- ExactMetrics: Update to 9.0.3. Audit your WordPress user list for unauthorized administrator accounts.
If you manage multiple WordPress sites, the W3 Total Cache situation highlights why WAF coverage and proactive monitoring matter — updates cannot protect you when a patch does not yet exist.
Looking Ahead
March 2026 reinforces a recurring theme: arbitrary file upload vulnerabilities continue to appear in plugins that handle user-supplied media or documents. The pattern is consistent and the fix is well-understood — yet implementation failures persist. Any plugin that accepts file uploads should be treated as higher risk and monitored more closely in vulnerability databases.
We will publish the April 2026 roundup at the end of next month. In the meantime, the Patchstack database is updated daily and is free to search.
Related reading: How to Check if Your WordPress Plugins Have Security Vulnerabilities • Managed WordPress Hosting Plans • WordPress Development Services