This Vulnerability Details post about a vulnerability in the plugin W3 Total Cache provides the details of a vulnerability we ran across while collecting data on vulnerabliities discovered by others for our data set on vulnerabilities in WordPress plugins, so its contents are limited to customers of our service. If you are not currently a customer, you can sign up for free here. There are a lot of other reason that you will want to sign up beyond access to posts like this one, including that you would have already been warned about this vulnerability if your website was vulnerable due to it.
WordPress gets a lot of criticism when it comes to security, with most of it being unwarranted (possibly making it harder the people behind it to realize when the criticism is warranted and a change really is needed). In reality they do a lot of things of good things and have for a long time. One element they have long done is to not push out security updates as part of major releases. In the past they often would put out new minor releases with security updates ahead of a major release and more recently they have been continuing to put out security updates for older versions going back to WordPress 3.7 (that version introduced automatic background updates). Not everybody else does that and it can lead to bad situations like the current with the W3 Total Cache plugin.
On Monday we introduced a new feature to the service that lets you know how likely is that a WordPress plugin vulnerability is to be exploited. In explaining why we thought the new feature would be useful we wrote in part: