The W3 Total Cache plugin for WordPress fails to validate the path used to construct cache file names, enabling an unauthenticated attacker to create or overwrite files in any existing directory, including directories outside the web root. This constitutes a CWE-22 Path Traversal weakness. On Apache servers the same flaw also overwrites the site’s .htaccess, which can break the site and strip hardening rules that other security controls rely on.

All WordPress sites running W3 Total Cache version 2.10.4 or earlier are affected. Any installation of the plugin before the 2.10.5 release, regardless of whether the site is served by Apache or another web server, is vulnerable.

The flaw carries a CVSS score of 10.0, indicating maximum severity. The EPSS score is less than 1%, suggesting a low probability of exploitation at the moment, yet the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the issue by crafting HTTP requests that include a path traversal component; authentication is not required. If an attacker writes malicious code, the description does not explicitly state the outcome; it is inferred that this could lead to arbitrary code execution or defacement.