W3 Total Cache EUVD-2026-53902

No authentication is required - exploitation is available to any remote attacker without credentials (CVSS PR:N, AV:N, AC:L, UI:N confirmed by both the CVE description 'Unauthenticated' and the vector). The target site must have the W3 Total Cache plugin installed and active in a version at or below 2.10.2; no additional non-default configuration is indicated in available data. Exploitation is bounded to WordPress environments running this specific plugin. The C:N metric limits exposure: the traversal does not appear to allow arbitrary file reads, constraining the attacker to file write or manipulation primitives (I:L, A:L). Filesystem-level write access is further constrained by the web server process permissions on the host.

The CVSS 6.5 Medium score is consistent with the attack profile: fully unauthenticated network exploitation with low complexity makes mass opportunistic scanning trivial, but the limited I:L/A:L impact caps real-world damage per instance below critical thresholds. No EPSS data was provided, so exploitation probability cannot be quantified from that signal. No CISA KEV listing and no public POC code are present in the available intelligence, suggesting exploitation has not been observed at scale. However, W3 Total Cache has historically held over one million active WordPress installations - the combination of broad attack surface and zero authentication requirements means that even a medium-severity finding warrants prompt patching given the volume of exposed instances. The C:N metric is notable: defenders should verify with the vendor whether this truly excludes file-read primitives, as path traversal vulnerabilities sometimes have broader impact than initial scoring reflects.

An unauthenticated attacker sends a crafted HTTP GET or POST request to a WordPress site running W3 Total Cache ≤ 2.10.2, embedding path traversal sequences (e.g., '../../') in a parameter processed by the plugin's cache file handler. The unsanitized input causes the plugin to write or delete a file at an attacker-controlled path outside the cache directory - for example, overwriting a PHP file in the WordPress uploads directory or corrupting a plugin asset. No public POC has been identified at time of analysis, but the AC:L/PR:N/UI:N profile means any published exploit would enable immediate mass exploitation across the large W3 Total Cache install base.