CVE-2026-107321: W3 Total Cache Path Traversal Vulnerability

CVE-2026-107321 Overview

CVE-2026-107321 affects the W3 Total Cache WordPress plugin in versions before 2.10.6. The plugin's media-import feature fails to restrict file copy operations to the document root and does not enforce an effective file-type restriction. Authenticated users with the Author role or higher can stage content that, when an administrator triggers the import, copies arbitrary server-readable files into a publicly served directory. The copied files become retrievable without authentication, exposing sensitive server-side data. The flaw is categorized under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Authenticated low-privilege users can coerce an administrator into exposing arbitrary server-readable files, including WordPress configuration data, to unauthenticated attackers.

Affected Products

W3 Total Cache WordPress plugin versions prior to 2.10.6
WordPress sites running the plugin with Author-or-higher accounts
Multi-author WordPress deployments where administrators process media imports

Discovery Timeline

2026-10-10 - CVE-2026-107321 published to the National Vulnerability Database (NVD)
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-107321

Vulnerability Analysis

The vulnerability resides in the W3 Total Cache plugin's media-import workflow. The import routine accepts user-supplied source paths and copies files to a destination under WordPress-served directories. The plugin does not confine the source argument to the document root, allowing references to arbitrary filesystem locations readable by the web server user.

Because the file-type validation is ineffective, attackers can target files such as wp-config.php, SSH private keys, or environment files. The copied content lands in a publicly accessible directory, where any unauthenticated visitor can retrieve it over HTTP. The attack chain requires an Author-role actor to plant the malicious import payload and an administrator to execute the import, which satisfies the user-interaction requirement.

Root Cause

The root cause is improper path canonicalization and absent allowlist enforcement in the media-import file copy routine. The plugin trusts attacker-influenced path input without resolving the final path and verifying containment within an expected base directory. The missing file-type restriction compounds the issue by permitting non-media files to pass through the import pipeline.

Attack Vector

Exploitation requires an authenticated account at the Author privilege level or higher and administrator interaction to initiate the import. The attacker plants crafted import metadata referencing a sensitive server-side path. When the administrator runs the import, the plugin reads the target file and writes it to the public uploads directory. The attacker then retrieves the exposed file over the network without any authentication. Refer to the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-107321

Indicators of Compromise

Unexpected non-media files (.php, .env, .key, .pem, .sql) appearing under wp-content/uploads/
Media library entries referencing source paths outside the WordPress document root
Unauthenticated HTTP GET requests to uploaded files containing configuration-like content
Audit log entries showing Author-role users creating import jobs targeting absolute system paths

Detection Strategies

Inventory WordPress installations for W3 Total Cache versions earlier than 2.10.6
Hash and compare files inside wp-content/uploads/ against expected media MIME types
Review web server access logs for retrieval of files with suspicious extensions in upload directories
Correlate administrator import actions with subsequent file creations in publicly served paths

Monitoring Recommendations

Enable WordPress audit logging for media import and plugin activity events
Alert on file creation events in wp-content/uploads/ where the file type does not match an image, video, or audio MIME type
Monitor outbound traffic for bulk download patterns targeting the uploads directory from a single source

How to Mitigate CVE-2026-107321

Immediate Actions Required

Upgrade the W3 Total Cache plugin to version 2.10.6 or later on all WordPress instances
Audit wp-content/uploads/ for non-media files and remove any unauthorized content
Rotate any secrets, API keys, or credentials that may have resided in server-readable files exposed by the plugin
Review Author-and-above user accounts and revoke access for untrusted contributors

Patch Information

The vendor addressed CVE-2026-107321 in W3 Total Cache version 2.10.6. The patched release enforces document-root containment on media-import file copy operations and applies effective file-type restrictions. Administrators should apply the update through the WordPress plugin manager or via WP-CLI. See the WPScan Vulnerability Report for advisory details.

Workarounds

Restrict the Author role and above to trusted users until the patch is applied
Disable the W3 Total Cache media-import functionality where feasible
Deploy a web application firewall rule to block requests to non-media file extensions under wp-content/uploads/
Configure the web server to deny execution and direct access to .php, .env, and key files within upload directories

bash

# Example nginx configuration to block sensitive file types in uploads
location ~* ^/wp-content/uploads/.*\.(php|env|key|pem|sql|conf|ini)$ {
    deny all;
    return 403;
}