CVE-2026-107321: unknown w3 total cache Path Traversal

Vulnerability summary

CVE-2026-107321 is a medium (CVSS 6.5) Path Traversal vulnerability in unknown w3 total cache. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.5% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 2.10.6.

Timeline

1. 10-10-2026
   PublishedVulnerability first disclosed.
2. 10-10-2026
   Last modifiedVulnerability information updated.

Description

The W3 Total Cache WordPress plugin before 2.10.6 does not confine a media-import file copy to the document root, nor enforce an effective file-type restriction on it, allowing users with the Author role or higher to plant content that, once an administrator runs the import, copies an arbitrary server-readable file into a publicly served directory, exposing it to unauthenticated retrieval.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.