CVE-2019-6715

CVE-2019-6715 describes an arbitrary file read vulnerability in the W3 Total Cache plugin for WordPress, affecting versions prior to 0.9.4. An unauthenticated attacker can exploit this by manipulating the SubscribeURL field within SubscriptionConfirmation JSON data sent to pub/sns.php. This vulnerability carries a high severity CVSS score of 7.5, indicating a critical risk due to its network-based attack vector, low attack complexity, and potential for complete confidentiality compromise. While not listed on CISA's KEV catalog, its high EPSS score and the existence of Nuclei templates suggest a significant likelihood of exploitation, further evidenced by media coverage detailing its use against a high-profile target.