Unauthenticated Path Traversal in the WordPress W3 Total Cache plugin versions 2.10.2 or earlier allows an attacker to request arbitrary files through crafted URLs, potentially exposing sensitive configuration, credential, or code files. This weakness is classified as CWE‑35 and can lead to information disclosure or even remote code execution if the read content is subsequently executed. The flaw exists in the plugin's handling of file paths, ignoring authentication and proper sanitisation.

The vulnerability affects the WordPress W3 Total Cache plugin from BoldGrid, specifically versions up to and including 2.10.2. Any WordPress installation that has this plugin installed and has not applied the latest patch is susceptible, regardless of user role or site level.

The CVSS score of 6.5 places the issue in the medium severity range, and there is no public indication of prior exploitation or inclusion in CISA KEV. Although the EPSS score is not listed, the lack of authentication makes the attack vector straightforward: an external attacker can send a specially crafted HTTP request to the plugin’s endpoint to traverse directories. Because the flaw does not require special privileges or complex conditions, the likelihood of exploitation remains non‑negligible for sites that have not yet patched.