CVE Database /
CVE-2026-9282
CVE · High
CVE-2026-9282 — W3 Total Cache [w3-total-cache] < 2.10.0
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2026-9282
|
W3 Total Cache [w3-total-cache] < 2.10.0 |
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
High
7.5
|
< 2.10.0
|
2.10.0 |
2026-07-10 |
—
|
CVE-2026-9282
A vulnerability exists in W3 Total Cache for WordPress, affecting versions up to 2.9.4, where an attacker can access arbitrary server files containing sensitive data without authentication by manipulating manual minify settings. This occurs when manual minify mode is enabled and a specific filename is provided, allowing the hash to remain empty and certain array entries to be overwritten. The setupSources function in W3 Total Cache facilitates this unauthorized file access.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings