W3 TOTAL CACHE WORDPRESS PLUGIN VULNERABLE TO PHP COMMAND INJECTION

Summary from the TLDR InfoSec newsletter

WordPress security company WPScan discovered a vulnerability in the W3 Total Cache plugin that enables unauthenticated attackers to execute code by posting a comment with a malicious payload. A patch is available. WPScan is withholding proof-of-concept details until November 24 to give site owners time to update.