Description
The W3 Total Cache WordPress plugin before 2.10.6 does not confine a media-import file copy to the document root, nor enforce an effective file-type restriction on it, allowing users with the Author role or higher to plant content that, once an administrator runs the import, copies an arbitrary server-readable file into a publicly served directory, exposing it to unauthenticated retrieval.
Published: 2026-10-10
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized File Disclosure
Action: Patch
AI Analysis

Impact

The W3 Total Cache WordPress plugin before version 2.10.6 allows an authenticated Author or higher user to import a media file that is not confined to the document root and is not filtered by file type. The import operation copies the file into a publicly served directory, making it retrievable by anyone without authentication.

Affected Systems

WordPress sites running W3 Total Cache < 2.10.6. Any user with Author or higher privileges can exploit the flaw, regardless of the server environment.

Risk and Exploitability

The vulnerability is assessed with a CVSS base score of 5.4. The EPSS score is 0.0016 (<1%), indicating a very low but nonzero likelihood of exploitation. It is not listed in the CISA KEV catalog. Successful exploitation results in disclosure of arbitrary server‑readable files to the public, violating confidentiality.

Generated by OpenCVE AI on October 10, 2026 at 16:06 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade W3 Total Cache to version 2.10.6 or newer, which limits media imports to the document root and validates file types.
  • If upgrading immediately is not possible, restrict the CDN Media Library Import functionality to administrators only, and disable author uploads for media content.
  • Configure the web server to deny access to directories that may contain improperly uploaded files or relocate the import destination outside the publicly served path.
  • Enable strict file‑type validation for uploads, either through plugin settings or a security plugin that blocks insecure file types.

Generated by OpenCVE AI on October 10, 2026 at 16:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 06:45:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress-extensions
Wordpress-extensions w3 Total Cache
Vendors & Products Wordpress-extensions
Wordpress-extensions w3 Total Cache

Sat, 10 Oct 2026 14:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20

Sat, 10 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 10 Oct 2026 08:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
CWE-22

Sat, 10 Oct 2026 06:15:00 +0000

Type Values Removed Values Added
Description The W3 Total Cache WordPress plugin before 2.10.6 does not confine a media-import file copy to the document root, nor enforce an effective file-type restriction on it, allowing users with the Author role or higher to plant content that, once an administrator runs the import, copies an arbitrary server-readable file into a publicly served directory, exposing it to unauthenticated retrieval.
Title W3 Total Cache < 2.10.6 - Author+ Path Traversal via CDN Media Library Import
References

Subscriptions

Wordpress-extensions W3 Total Cache
cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-10-10T12:06:41.538Z

Reserved: 2026-10-07T17:35:55.533Z

Link: CVE-2026-107321

cve-icon Vulnrichment

Updated: 2026-10-10T12:02:17.051Z

cve-icon NVD

Status : Deferred

Published: 2026-10-10T06:16:41.017

Modified: 2026-10-13T20:36:00.850

Link: CVE-2026-107321

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T06:30:05Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')