CVE-2026-107321mediumCWE-22

CVE-2026-107321: medium-severity vulnerability in W3 Total Cache

W3 Total Cache < 2.10.6 - Author+ Path Traversal via CDN Media Library Import

Published

Follow this CVE+ Monitor W3 Total Cache

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.4epss 0.2%
The W3 Total Cache WordPress plugin before 2.10.6 does not confine a media-import file copy to the document root, nor enforce an effective file-type restriction on it, allowing users with the Author role or higher to plant content that, once an administrator runs the import, copies an arbitrary server-readable file into a publicly served directory, exposing it to unauthenticated retrieval.
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N
Affected products
Unknown · W3 Total Cache
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — W3 Total Cache

In the same product, most dangerous first.

CVE-2025-9501CRITICALW3 Total Cache < 2.8.13 - Unauthenticated Command InjectionEPSS 22.1%CVE-2026-18051CRITICALW3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache KeyEPSS 2.0%