CVE-2026-18051 (CVSS 10): Unauthenticated Arbitrary File Write Hits 900k W3 Total Cache Sites
Do Son 
TL;DR
A critical W3 Total Cache vulnerability lets unauthenticated attackers write files anywhere on the server. Tracked as CVE-2026-18051, it earns the top CVSS score of 10. The plugin runs on more than 900,000 WordPress sites.
- CVE: CVE-2026-18051
- CVSS: Awaiting analysis
- Product: Unknown W3 Total Cache
- Affected: < 2.10.5
- Impact: W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key
- Status: No confirmed exploitation yet
- Patched in: 2.10.5
- Action: Update to 2.10.5 now
Why it matters
W3 Total Cache is one of WordPress’s most popular caching plugins. It improves site speed, SEO, and Core Web Vitals. This flaw needs no login and no user interaction. That combination makes the W3 Total Cache vulnerability easy to abuse at scale.
The bug carries a perfect CVSS score of 10. Few flaws reach that rating. It falls under CWE-22, the path traversal weakness class, and maps to the OWASP injection category.
How the attack works
The plugin builds cache file names from the request path. However, it fails to validate that path. As a result, an attacker can use path traversal to escape the cache folder.
An unauthenticated arbitrary file write then becomes possible. The attacker can drop or overwrite a file in any existing directory, inside or outside the web root. On Apache servers, the flaw overwrites .htaccess files.
Overwriting .htaccess can break the site outright. Worse, it can strip hardening rules that other security controls depend on.
Affected versions
The bug affects W3 Total Cache before version 2.10.5. Researcher Jakub Herman reported it. The advisory notes a public proof-of-concept is scheduled for release on September 17, 2026, to give admins time to patch.
Patch and mitigation
Update immediately. The fix ships in W3 Total Cache 2.10.5. No exploitation in the wild has been confirmed at this time.
Review the full WPScan advisory for CVE-2026-18051 for details. After patching, check your .htaccess files for unexpected changes and restore any missing hardening rules.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
