CVE-2023-5359 is a low severity (CVSS 3.7) sensitive information exposure in the W3 Total Cache WordPress plugin, versions up to and including 2.7.5. Google OAuth API secrets were stored in plaintext in the public source. The referenced changeset sits under the 2.7.6 tag, so update to 2.7.6 or later.
What's affected
The NVD record says W3 Total Cache for WordPress is vulnerable to sensitive information exposure in versions up to and including 2.7.5, because Google OAuth API secrets were stored in plaintext in the publicly visible plugin source. This could allow unauthenticated attackers to impersonate W3 Total Cache and gain access to user account information in successful conditions.
The record states that this would not impact the WordPress site of the user in any way. The exposed secret belongs to the plugin project, used for its PageSpeed integration, not to your site.
The record links the plugin source file and a changeset under the 2.7.6 tag of the plugin repository. That points to 2.7.6 as the release that changed the file. We could not read the Wordfence entry, so confirm the fixed version in the plugin changelog.
How to check if you're exposed
Read the installed version with WP-CLI or the Plugins page.
wp plugin list --format=table
wp plugin get w3-total-cache --fields=name,status,version
Versions up to 2.7.5 are in scope. If you use the Google PageSpeed features of the plugin, note when you connected your account, since the record talks about account information reachable through the OAuth flow.
Review the Google account permissions you granted to apps, and remove any you do not recognise.
What to do now
- Update W3 Total Cache to 2.7.6 or later.
- Confirm the fixed version in the plugin changelog.
- Review the connected apps in your Google account if you used the PageSpeed integration.
- Keep automatic plugin updates on for caching and performance plugins.
- Search your own code for credentials stored in source, since the same class of mistake applies to any project.
Why it matters
The record lists CWE-200, CWE-312, exposure of sensitive information and cleartext storage of sensitive information. The secret was part of the distributed source, so anyone who downloaded the plugin could read it.
Client secrets for OAuth apps are meant to be private, and shipping one in a public plugin defeats that. The impact here is small, which is why the score is low, but the lesson is common. Secret scanning in the build pipeline catches this class early. The record does not claim exploitation and the CVE is not in the CISA KEV catalog.
Quick check
Is my WordPress site at risk?
The record says it would not impact the site of the user. The exposed secret belongs to the plugin integration, so the risk is mostly to the Google account link.
Sources
Last reviewed: 19 October 2026.
