EUVD-2026-53902
GHSA-qwxj-263x-rfqj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Plugin is network-accessible with no auth required (AV:N/PR:N/UI:N); C:N reflects write-only traversal behavior; I:L and A:L reflect limited file manipulation impact within web server permissions.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Path Traversal in W3 Total Cache <= 2.10.2 versions.
AnalysisAI
Path traversal in W3 Total Cache WordPress plugin (versions ≤ 2.10.2) enables remote unauthenticated attackers to manipulate files outside the intended cache directory without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier network exploitation; the C:N/I:L/A:L impact profile indicates this traversal affects file integrity and availability rather than exposing arbitrary file reads, suggesting a write- or delete-capable traversal rather than a classic information-disclosure variant. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required - exploitation is available to any remote attacker without credentials (CVSS PR:N, AV:N, AC:L, UI:N confirmed by both the CVE description 'Unauthenticated' and the vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 Medium score is consistent with the attack profile: fully unauthenticated network exploitation with low complexity makes mass opportunistic scanning trivial, but the limited I:L/A:L impact caps real-world damage per instance below critical thresholds. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade W3 Total Cache to the first release above version 2.10.2 - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/w3-total-cache/vulnerability/wordpress-w3-total-cache-plugin-2-10-2-path-traversal-vulnerability and the WordPress plugin repository changelog to identify the confirmed patched release, as no exact fix version is present in the current intelligence. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in W3 Total Cache
View allThe W3 Total Cache plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.
pub/sns.php in the W3 Total Cache plugin before 0.9.4 for WordPress allows remote attackers to read arbitrary files via
The W3 Total Cache plugin before 0.9.4.1 for WordPress does not properly handle empty nonces, which allows remote attack
The W3 Total Cache WordPress plugin before 2.1.5 was affected by a reflected Cross-Site Scripting (XSS) issue within the
The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulne
Unauthenticated arbitrary code execution affects the W3 Total Cache WordPress caching plugin in all versions up to and i
The W3 Total Cache WordPress plugin before 2.1.3 did not sanitise or escape some of its CDN settings, allowing high priv
Cross-site scripting (XSS) vulnerability in the W3 Total Cache plugin before 0.9.4.1 for WordPress, when debug mode is e
Stored cross-site scripting in W3 Total Cache WordPress plugin (all versions through 2.10.3) allows unauthenticated atta
W3 Total Cache for WordPress (versions through 2.9.1) exposes Author-role users to administrative plugin functions due t
The W3 Total Cache plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check o
The W3 Total Cache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability c
Same weakness CWE-35 – Path Traversal: '.../...//'
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today