EUVD-2026-62277
GHSA-3qrw-968g-4hqv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted HTTP request with traversal path
-
DeliveryPlugin builds cache filename from unvalidated path
-
ExploitWrite resolves outside cache directory
-
ExecutionOverwrite existing .htaccess or sensitive file
-
ImpactStrip hardening rules and break site
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default installs of the W3 Total Cache plugin (versions before 2.10.5) on WordPress, per CVSS AV:N/AC:L/PR:N/UI:N. The only hard requirement is that the plugin is installed and active and that the target directory/file already exists (the flaw overwrites an existing name rather than creating arbitrary new paths). Impact is maximized on Apache deployments where per-directory .htaccess files are present and relied upon for security; on non-Apache stacks (e.g. nginx) the .htaccess overwrite vector does not apply, though overwriting other existing files remains possible. There is no user-interaction or authentication limiting factor to reduce realistic risk. |
| Impact | The signals partially conflict and should be read together. The published CVSS is 10.0 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H, indicating a remote, low-complexity, unauthenticated attack with scope change and high integrity and availability impact but no confidentiality loss - consistent with a blind file-overwrite rather than data theft. CISA SSVC frames it as Exploitation: none (no observed activity), Automatable: yes, Technical Impact: total, which supports treating it as a serious latent risk. In tension with the maximal CVSS, EPSS is only 0.18% (8th percentile) and it is not on CISA KEV, meaning no evidence of active or widespread exploitation yet. Net: this is a genuinely high-priority patch for any Internet-facing WordPress site running the plugin because exploitation is unauthenticated and automatable, but the low EPSS and absence of KEV listing mean it is currently a proactive-hardening priority rather than a confirmed in-the-wild emergency. |
| Exploit ScenarioDerived | An attacker sends a crafted HTTP request whose path embeds traversal sequences so that W3 Total Cache resolves the cache filename to a sensitive location such as the site root's .htaccess. Because no authentication or user interaction is required, the plugin writes cache output over that file, corrupting Apache configuration and removing rewrite-based access controls and hardening rules. No public proof-of-concept has been identified at time of analysis, but the low attack complexity and automatable nature make reliable scripting of the attack straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 19, 2026
Arbitrary file write in the W3 Total Cache WordPress plugin before 2.10.5 lets unauthenticated remote attackers overwrite any existing file inside or outside the web root by manipulating the request path used to construct cache file names. Because the plugin builds cache filenames from an unvalidated path, attackers can clobber security-critical files such as Apache .htaccess, breaking the site and stripping hardening rules that other controls depend on. No public exploit identified at time of analysis and EPSS is low (0.18%), but SSVC rates technical impact as total and the flaw is automatable, so priority is high despite the current lack of observed exploitation.
RemediationAI
Vendor-released patch: upgrade W3 Total Cache to version 2.10.5 or later, which validates the request path used for cache file names; this is the primary and recommended fix (see the WPScan advisory at https://wpscan.com/vulnerability/dc56cdd2-419b-4a64-9d2a-29dc7e79cb6d/ and NVD https://nvd.nist.gov/vuln/detail/CVE-2026-18051). If you cannot patch immediately, deactivate and remove the W3 Total Cache plugin to eliminate the vulnerable code path, accepting the trade-off of losing caching and a likely performance drop under load. As an interim compensating control, place a WAF or reverse-proxy rule in front of the site to block request paths containing traversal sequences (encoded and raw '../') targeting the plugin's cache endpoints, understanding this is signature-based and may be bypassable; and on Apache, monitor .htaccess files for unexpected modification (file-integrity monitoring) so that any overwrite that strips hardening rules is detected and can be restored from backup.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
W3 Total Cache is a full-page and object caching plugin for WordPress that writes generated cache artifacts to disk, deriving each cache file's path and name from the incoming HTTP request. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal): the plugin fails to sanitize the request path before using it to build the cache file name, so traversal sequences let the write target escape the intended cache directory. Any existing directory on the host - including locations outside the web root - can be reached, and the target file is overwritten with plugin-controlled cache output. On Apache deployments this is especially damaging because the affected files include per-directory .htaccess configuration, which governs rewrite rules, access restrictions, and security hardening directives.
Know when WordPress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Unauthenticated remote path traversal (PR:N/AV:N/AC:L) writing files outside the intended cache dir (S:C) with no read primitive (C:N) but full integrity and availability loss (I:H/A:H).
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
4DescriptionCVE.org
The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target name. On Apache, the same flaw overwrites the site's .htaccess files, which breaks the site and can strip hardening rules that other security measures rely on.
Articles & Coverage 2
Executive ViewAI
W3 Total Cache, installed on thousands of WordPress sites, contains a critical vulnerability that allows attackers to remotely disable security protections without any authentication, creating risk of site compromise and data exposure. While this vulnerability has not been widely exploited to date, the severity and ease of exploitation make it an urgent threat requiring immediate patching. Organizations must update to version 2.10.5 immediately to restore security protection.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Exploit-DB