What is the CVSS score of CVE-2026-9282?

CVE-2026-9282 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of W3 Total Cache are affected by CVE-2026-9282?

W3 Total Cache, a WordPress plugin installed on thousands of sites, contains a file disclosure vulnerability (CVE-2026-9282) that allows unauthenticated remote attackers to read sensitive server…

Is there a public PoC exploit available for CVE-2026-9282?

Yes, a public proof-of-concept exploit is available for CVE-2026-9282. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-9282?

Within 24 hours: Audit all WordPress installations for W3 Total Cache plugin presence and determine which sites have manual minify mode enabled. Within 7 days: Disable W3 Total Cache plugin entirely or disable its minify functionality; implement web server access controls to restrict requests to plugin directories. Within 30 days: Monitor Wordfence security advisories and plugin repositories for patch release; evaluate alternative WordPress caching solutions.

W3 Total Cache CVE-2026-9282

EUVD-2026-43164 HIGH

Path Traversal (CWE-22)

2026-07-11 security@wordfence.com

GHSA-cx46-vqrj-hfqm

WordPress Path Traversal

7.5

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

Network and unauthenticated (AV:N/PR:N), but the required non-default manual-minify configuration and crafted empty-hash filename make success condition-dependent (AC:H); confidentiality-only file read (C:H, I/A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorVendor: wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 11, 2026 - 07:32 vuln.today

CVE Published

Jul 11, 2026 - 07:16 nvd

HIGH 7.5

DescriptionCVE.org

The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires enabling manual minify mode and supplying a manual-format minify filename so that the hash is empty and the f_array[] entries are not overwritten before reaching setupSources().

Articles & Coverage 1

News 16 New WordPress Vulnerabilities - 16 High Severity Jul 12, 2026

AnalysisAI

Arbitrary file disclosure in the W3 Total Cache plugin for WordPress (versions ≤ 2.9.4) lets remote unauthenticated attackers read any file readable by the web server via a path traversal in the Minify subsystem's setupSources function. Exploitation is gated on the site running manual minify mode with a crafted manual-format filename, so it is not universally triggerable, and there is no public exploit identified at time of analysis. The flaw was reported by Wordfence and can expose credentials, wp-config.php secrets, and other sensitive server files.

Technical ContextAI

W3 Total Cache is a performance/caching plugin whose Minify feature concatenates and compresses CSS/JS assets. The vulnerability is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) reached through Minify_MinifiedFileRequestHandler.php and the bundled Minify library's MinApp controller (lib/Minify/Minify/Controller/MinApp.php around lines 109 and 163). When manual minify mode is used, a manual-format minify filename causes the internal hash to be empty so the f_array[] source entries are not sanitized/overwritten before setupSources() consumes them, allowing attacker-controlled path segments to escape the intended asset directory. The referenced changeset (r3585227) is the upstream fix. Affected component per NVD CPE is the w3-total-cache WordPress plugin.

RemediationAI

Upgrade W3 Total Cache to the version above 2.9.4 that includes the upstream fix committed in changeset r3585227 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3585227%40w3-total-cache&new=3585227%40w3-total-cache); the input does not name an exact released tag, so confirm the fixed release number in the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/e92cc06d-006f-4bba-a4ef-b23d80c00085) before deploying. Where immediate patching is not possible, disable manual minify mode in the plugin's Minify settings (switching to auto minify or disabling Minify removes the specific code path, at the cost of losing manual asset control), and/or place a WAF/rule to block minify requests containing traversal sequences (../, encoded %2e%2e) - noting WAF rules can be bypassed and may break legitimate minify URLs. Additionally restrict file permissions so the web server user cannot read sensitive files outside the webroot as a defense-in-depth measure.