CVE-2026-18051: W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key
The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target name. On Apache, the same flaw overwrites the site's .htaccess files, which breaks the site and can strip hardening rules that other security measures rely on.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
W3 Total Cache WordPress pluginto a version that resolves this vulnerability.Fixed in 2.10.5 - Compensating control
For Apache, mitigate the impact of .htaccess overwrite by ensuring hardening rules are not solely dependent on site .htaccess files (e.g., move critical protections to Apache main configuration) so that if .htaccess is overwritten, core security controls remain in place.
Event History
Frequently Asked Questions
Which deployments are most exposed to the .htaccess impact?
Apache-hosted WordPress sites using an affected W3 Total Cache version are exposed to .htaccess overwrites. This can break the site and remove hardening rules relied upon by other security measures.
Does exploitation require an authenticated WordPress account?
No. The flaw is exploitable by unauthenticated attackers through the request path used to build cache file names.
What conditions are required for arbitrary file writes?
The attacker can write a file into any directory that already exists on the server, including directories inside or outside the web root. The vulnerability can overwrite whatever occupies the chosen target name.