CVE-2026-107321: W3 Total Cache < 2.10.6 - Author+ Path Traversal via CDN Media Library Import
The W3 Total Cache WordPress plugin before 2.10.6 does not confine a media-import file copy to the document root, nor enforce an effective file-type restriction on it, allowing users with the Author role or higher to plant content that, once an administrator runs the import, copies an arbitrary server-readable file into a publicly served directory, exposing it to unauthenticated retrieval.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
W3 Total Cache WordPress pluginto a version that resolves this vulnerability.Fixed in 2.10.6
Event History
Frequently Asked Questions
Who needs access for this issue to be exploited?
An attacker needs a WordPress account with the Author role or higher. They also need an administrator to run the affected CDN Media Library import before the file is copied into a publicly served location.
What is exposed after a successful exploit?
An arbitrary file that the server can read may be copied into a publicly served directory. Once copied, its contents can be retrieved without authentication.
Which deployments are affected?
Deployments using BoldGrid W3 Total Cache versions earlier than 2.10.6 are affected where an Author-or-higher user can prepare the import content and an administrator runs the CDN Media Library import.