The W3 Total Cache plugin for WordPress suffers from a directory traversal flaw that can be triggered by the f_array[] parameter inside the minification subsystem. When manual minify mode is active and the request supplies a manual-format minify filename with an empty hash, the plugin’s setupSources function resolves the supplied paths without proper sanitization, allowing an unauthenticated attacker to read the contents of any file on the server. The vulnerability exposes sensitive information, such as configuration data or credentials, and represents a classic file path traversal weakness identified as CWE‑22.

BoldGrid’s W3 Total Cache plugin, versions up to and including 2.9.4, is affected. The flaw is active when manual minify mode is enabled; normal or automatic minify mode does not expose the vulnerable code path.

The CVSS score of 7.5 classifies the issue as high severity, while the EPSS score of 3% suggests exploitation is relatively rare. The vulnerability is not listed in the CISA KEV catalog, further suggesting low public exploitation activity. Attackers need only send a crafted HTTP request targeting the Minify subsystem with manual mode enabled and an appropriately constructed f_array[] payload; authentication is not required. Successful exploitation would allow an attacker to read arbitrary files on the affected server.