WordPress Plugin Vulnerabilities

W3 Total Cache < 2.10.3 - Unauthenticated Path Traversal

Description

The plugin is vulnerable to Path Traversal. This makes it possible for unauthenticated attackers to perform actions on files outside of the originally intended directory.

Affects Plugins

Plugin icon
w3-total-cache
Fixed in 2.10.3

References

CVE
CVE-2026-66695
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/60878165-d4cc-4ea1-acf7-9bb6fd48795b

Classification

Type
LFI
OWASP top 10
A1: Injection
CWE
CWE-22
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Mykel Nelson
Verified
No
WPVDB ID
145326c3-7555-4fd8-a8be-bc082c2b3a04

Timeline

Publicly Published
2026-07-31 (about 24 days ago)
Added
2026-08-04 (about 19 days ago)
Last Updated
2026-08-04 (about 19 days ago)

Other

Published
Title
Published
2025-04-07
Title
Nomupay Payment Processing Gateway < 7.1.6 - Authenticated (Subscriber+) Arbitrary File Download
Published
2025-08-25
Title
UPC/EAN/GTIN Code Generator < 2.0.3 - Authenticated (Subscriber+) Arbitrary File Deletion
Published
2022-03-23
Title
Amministrazione Aperta < 3.8 - Admin+ LFI
Published
2026-07-08
Title
Forminator < 1.55.1 - Unauthenticated Arbitrary File Read
Published
2024-12-11
Title
Bold Page Builder < 5.1.6 - Authenticated (Editor+) Path Traversal