CVE-2026-18051

Name of the Vulnerable Software and Affected Versions W3 Total Cache WordPress plugin versions prior to 2.10.5

Description The plugin fails to properly validate the request path used to generate cache file names. This allows unauthenticated attackers to write files to any existing directory on the server, whether inside or outside the web root, potentially overwriting existing files. On Apache servers, this flaw can be used to overwrite .htaccess files, which can lead to site failure and the removal of security hardening rules.

Recommendations Update W3 Total Cache WordPress plugin to version 2.10.5 or later.