CVE-2026-107321

Deferred Deferred - Pending Action

W3 Total Cache File Copy to Document Root Vulnerability

Publication date: 2026-10-10

Last updated on: 2026-10-13

Assigner: WPScan

Description

The W3 Total Cache WordPress plugin before 2.10.6 does not confine a media-import file copy to the document root, nor enforce an effective file-type restriction on it, allowing users with the Author role or higher to plant content that, once an administrator runs the import, copies an arbitrary server-readable file into a publicly served directory, exposing it to unauthenticated retrieval.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-10

EPSS Evaluated

2026-10-18

NVD

CVE-2026-107321

EUVD

EUVD-2026-96127

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	W3	Total Cache 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal flaw in the W3 Total Cache WordPress plugin before version 2.10.6. It allows users with Author role or higher to exploit the CDN media library import feature to copy arbitrary server-readable files into publicly accessible directories. The issue bypasses document root restrictions and file-type checks, exposing sensitive files to unauthenticated retrieval when an administrator runs the import process.

Detection Guidance

Check if the W3 Total Cache plugin version is below 2.10.6. Look for unauthorized files in publicly accessible directories, especially those recently modified or with unusual names. Review server logs for suspicious import requests or file access patterns.

Impact Analysis

If exploited, this vulnerability could allow attackers to access sensitive files on your server, such as configuration files, logs, or other confidential data. This could lead to data breaches, unauthorized access to user information, or further compromise of your WordPress site or server.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if it results in unauthorized access to personal or health data. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. A breach could result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Update the W3 Total Cache plugin to version 2.10.6 or later immediately. Remove any unauthorized files found in public directories. Restrict Author role permissions to only necessary functions. Monitor network traffic for unusual file retrieval attempts.

Hi! I’m here to help you understand CVE-2026-107321. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70