EUVD-2026-43164
GHSA-cx46-vqrj-hfqm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WP site with W3 Total Cache manual minify
-
DeliveryCraft manual-format minify filename yielding empty hash
-
ExploitSubmit request with traversal in f_array source path
-
ExecutionsetupSources reads arbitrary file
-
ImpactExfiltrate sensitive file contents (e.g., wp-config.php)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target site to have the W3 Total Cache Minify feature configured in manual minify mode, and the attacker must supply a manual-format minify filename crafted so the computed hash is empty and the f_array[] source entries are not overwritten before reaching setupSources(). These are the exact prerequisites: without manual minify mode enabled the vulnerable path is not reached, which is the primary limiting factor. No authentication is required (PR:N) and no user interaction is needed (UI:N), so any remote party can attempt it against a qualifying, in-scope configuration; impact is limited to reading files accessible to the web server user (confidentiality only, no write/modify). |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) rates this HIGH with network, unauthenticated, low-complexity access and high confidentiality impact only - no integrity or availability effect. However, the description imposes a real gating condition the vector does not capture: the target must be running manual minify mode and receive a manual-format filename, which is a non-default configuration. This tension means the raw 7.5 overstates opportunistic risk against typical installs; realistic exploitation is limited to sites in that specific minify configuration. No EPSS score, KEV listing, POC, or SSVC data was provided, so exploitation likelihood cannot be quantified from the input. Net: a genuine unauthenticated info-disclosure priority for sites using manual minify, but the config prerequisite lowers mass-exploitation exposure relative to the headline score. |
| Exploit ScenarioDerived | On a WordPress site running W3 Total Cache ≤ 2.9.4 with manual minify enabled, an unauthenticated attacker sends a crafted minify request whose manual-format filename yields an empty hash, causing traversal source paths to survive into setupSources(). The response returns the contents of a targeted file such as wp-config.php, leaking database credentials and secret keys. No authentication or user interaction is required, though the manual-minify configuration must be present; no public exploit was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 11, 2026
Arbitrary file disclosure in the W3 Total Cache plugin for WordPress (versions ≤ 2.9.4) lets remote unauthenticated attackers read any file readable by the web server via a path traversal in the Minify subsystem's setupSources function. Exploitation is gated on the site running manual minify mode with a crafted manual-format filename, so it is not universally triggerable, and there is no public exploit identified at time of analysis. The flaw was reported by Wordfence and can expose credentials, wp-config.php secrets, and other sensitive server files.
RemediationAI
Upgrade W3 Total Cache to the version above 2.9.4 that includes the upstream fix committed in changeset r3585227 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3585227%40w3-total-cache&new=3585227%40w3-total-cache); the input does not name an exact released tag, so confirm the fixed release number in the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/e92cc06d-006f-4bba-a4ef-b23d80c00085) before deploying. Where immediate patching is not possible, disable manual minify mode in the plugin's Minify settings (switching to auto minify or disabling Minify removes the specific code path, at the cost of losing manual asset control), and/or place a WAF/rule to block minify requests containing traversal sequences (../, encoded %2e%2e) - noting WAF rules can be bypassed and may break legitimate minify URLs. Additionally restrict file permissions so the web server user cannot read sensitive files outside the webroot as a defense-in-depth measure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
W3 Total Cache is a performance/caching plugin whose Minify feature concatenates and compresses CSS/JS assets. The vulnerability is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) reached through Minify_MinifiedFileRequestHandler.php and the bundled Minify library's MinApp controller (lib/Minify/Minify/Controller/MinApp.php around lines 109 and 163). When manual minify mode is used, a manual-format minify filename causes the internal hash to be empty so the f_array[] source entries are not sanitized/overwritten before setupSources() consumes them, allowing attacker-controlled path segments to escape the intended asset directory. The referenced changeset (r3585227) is the upstream fix. Affected component per NVD CPE is the w3-total-cache WordPress plugin.
Know when WordPress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network and unauthenticated (AV:N/PR:N), but the required non-default manual-minify configuration and crafted empty-hash filename make success condition-dependent (AC:H); confidentiality-only file read (C:H, I/A:N).
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
DescriptionCVE.org
The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires enabling manual minify mode and supplying a manual-format minify filename so that the hash is empty and the f_array[] entries are not overwritten before reaching setupSources().
Articles & Coverage 1
Executive ViewAI
W3 Total Cache, a WordPress plugin installed on thousands of sites, contains a file disclosure vulnerability (CVE-2026-9282) that allows unauthenticated remote attackers to read sensitive server files including database credentials and configuration secrets. Organizations running WordPress with this plugin and manual minify mode enabled face direct exposure of critical authentication material and infrastructure details. Immediate identification and mitigation of affected instances is necessary to prevent credential compromise.
Disable W3 Total Cache plugin or set minify mode to disabled; implement Web Application Firewall (WAF) rules to detect and block path traversal sequences in HTTP requests; restrict operating system file permissions on wp-config.php and other sensitive configuration files; deploy WordPress-specific intrusion detection; perform audit log review to identify potential unauthorized file access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Exploit-DB