W3 Total Cache EUVD-2026-96127

Requires an authenticated attacker holding the WordPress Author role or higher on the target site, running W3 Total Cache before 2.10.6, AND an administrator subsequently executing the plugin's media-import action against the attacker-planted content (UI:R). Exploitation is limited by these factors: the attacker cannot complete the attack alone (a privileged admin must trigger the import), the target file must be readable by the web-server process, and the flaw yields disclosure only (no write/integrity or availability impact). The absence of an effective file-type restriction and the failure to confine the copy to the document root are the specific defects enabling arbitrary server-readable files to land in a publicly served directory.

This is a medium-severity, read-only information-disclosure flaw (CVSS 5.4; C:H but I:N/A:N) whose real-world priority is moderate rather than urgent. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so by the precision rules this is 'no public exploit identified at time of analysis' - there is no evidence of active or automated exploitation. The CVSS vector itself tempers the risk: AC:H and UI:R mean exploitation is not straightforward and depends on a separate privileged actor. Note a signal conflict: the supplied vector specifies PR:H, but the description states the attacker only needs the Author role (a low-privilege WordPress role), so the privilege requirement appears overstated - the real gating factor is that an administrator must independently run the media import (UI:R) over the attacker's planted content. Net: a legitimate issue worth patching on a normal cycle, not a high-CVSS-but-illusory finding, yet also not a drop-everything emergency given the absence of exploitation signals and the multi-actor precondition.

A contributor with an Author account on a shared WordPress site plants a crafted media-import entry pointing at a sensitive server file (e.g. wp-config.php or an SSH key) outside the document root. When an administrator later runs the W3 Total Cache media import, the plugin copies that file into a publicly served directory, letting the attacker - or anyone - retrieve it without authentication. No public exploit code was identified at the time of analysis, and the attack hinges on the admin triggering the import (UI:R).