CVE-2026-107321

Name of the Vulnerable Software and Affected Versions W3 Total Cache versions prior to 2.10.6

Description The plugin fails to confine media-import file copies to the document root and does not enforce effective file-type restrictions. This allows users with the Author role or higher to plant content that, when processed by an administrator during an import, copies an arbitrary server-readable file into a publicly served directory, making it accessible for unauthenticated retrieval. This issue involves a path traversal, which occurs when an application uses user-supplied input to construct a pathname that includes characters like "../" to access files outside the intended directory.

Recommendations Update W3 Total Cache to version 2.10.6 or later.