CVE-2026-18051

Deferred Deferred - Pending Action

Path Traversal in W3 Total Cache Plugin

Publication date: 2026-08-19

Last updated on: 2026-08-26

Assigner: WPScan

Description

The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target name. On Apache, the same flaw overwrites the site's .htaccess files, which breaks the site and can strip hardening rules that other security measures rely on.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-26

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-18051

EUVD

EUVD-2026-62277

Affected Vendors & Products

Vendor	Product	Version / Range
w3_edge	w3_total_cache	to 2.10.5 (exc)
wordpress	w3_total_cache	to 2.10.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal flaw in the W3 Total Cache WordPress plugin versions before 2.10.5. It allows unauthenticated attackers to write files into any directory on the server, including outside the web root. On Apache servers, it can overwrite .htaccess files, breaking the site and removing security hardening rules.

Detection Guidance

Check if the W3 Total Cache plugin version is below 2.10.5 by inspecting the plugin files or WordPress admin panel. Look for unexpected file modifications or new files in directories, especially .htaccess files on Apache servers.

Impact Analysis

An attacker could overwrite critical files like .htaccess, breaking your website and removing security measures. They could also place malicious files anywhere on the server, leading to potential data breaches, defacement, or further compromise of the system.

Compliance Impact

This vulnerability could lead to unauthorized file access or modification, potentially violating data protection requirements under GDPR or HIPAA. Compromised .htaccess files might weaken security controls, increasing the risk of data breaches and non-compliance with regulatory standards.

Mitigation Strategies

Immediately update the W3 Total Cache plugin to version 2.10.5 or later. Review file permissions and check for unauthorized file changes, particularly in .htaccess files. Consider disabling the plugin temporarily if an update is not immediately possible.

Hi! I’m here to help you understand CVE-2026-18051. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70