Description

The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target name. On Apache, the same flaw overwrites the site's .htaccess files, which breaks the site and can strip hardening rules that other security measures rely on.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-08-19T06:17:36.863Z",
  "pubdate": "2026-08-19T06:17:36.863Z",
  "executiveSummary": "An arbitrary file write vulnerability exists in the W3 Total Cache WordPress plugin affecting versions prior to 2.10.5. The flaw stems from improper validation of request paths utilized during cache file name generation. This security deficiency permits unauthenticated remote attackers to write files into any existing directory on the underlying server, encompassing locations both inside and outside the defined web root. Exploitation results in the overwriting of targeted files with arbitrary content supplied by the attacker. On Apache web server deployments, this capability enables the direct overwriting of critical .htaccess files, resulting in immediate denial of service through site breakage and the stripping of vital security hardening rules established by complementary security controls. The risk implications are severe due to the unauthenticated nature of the attack vector, requiring no prior privileges or user interaction, thereby exposing vulnerable WordPress installations to complete administrative disruption and potential system-level compromise depending on file system permissions and target file selection.",
  "technicalDetails": "The root cause of the vulnerability resides within the request path validation logic of the W3 Total Cache WordPress plugin prior to version 2.10.5. Specifically, the component responsible for constructing cache file names fails to adequately sanitize or validate user-supplied input contained within the request path. Because of this improper validation, an unauthenticated attacker interacting over the network can manipulate request parameters to traverse directory boundaries or inject controlled file paths into the cache generation mechanism.\nThe attack flow begins when an unauthenticated remote attacker crafts a malicious HTTP request directed at the vulnerable WordPress instance. The request contains specially engineered parameters designed to influence the path resolution logic within the W3 Total Cache plugin. As the vulnerable component processes the request to build the cache file name, it fails to enforce strict boundary checks, allowing the attacker to specify arbitrary destination paths on the server file system.\nDuring payload execution, the plugin writes cache data containing attacker-controlled content directly to the specified target path. This action results in the immediate overwriting of any existing file occupying the target name, provided the web server process possesses sufficient file system write permissions. The attack vector requires network access to the target WordPress site, operates entirely without authentication, and demands no privileged user interaction.\nThe post-exploitation impact varies based on the targeted file system location. When exploited against servers running the Apache HTTP Server, attackers frequently target the site's primary .htaccess configuration file. Overwriting the .htaccess file immediately invalidates existing routing rules and permalink structures, causing a denial of service. Furthermore, this action strips out critical security hardening directives and access control rules implemented by other security measures, leaving the underlying application and server environment significantly more vulnerable to subsequent attacks or unauthorized data access. The vulnerability affects all W3 Total Cache plugin installations prior to version 2.10.5."
}