PT-2026-57422 · WordPress · W3 Total Cache

Published 2026-07-11 · Updated 2026-07-11 · CVE-2026-9282

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions W3 Total Cache versions prior to 2.9.5

Description A Directory Traversal issue exists in the setupSources() function. This allows unauthenticated attackers to read arbitrary files on the server, potentially exposing sensitive information. Exploitation occurs when manual minify mode is enabled and a manual-format minify filename is provided, resulting in an empty hash and preventing f array[] entries from being overwritten before the function is executed.

Recommendations Update the plugin to version 2.9.5 or later. As a temporary mitigation, disable manual minify mode to prevent the exploitation of the setupSources() function.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-9282

Affected Products

W3 Total Cache

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-9282 · Security Note
• https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.9.4/lib/Minify/Minify/Controller/MinApp.php#L109 · Note
• https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.9.4/Minify_MinifiedFileRequestHandler.php#L191 · Note
• https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.9.4/lib/Minify/Minify/Controller/MinApp.php#L163 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e92cc06d-006f-4bba-a4ef-b23d80c00085?source=cve · Note
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3585227%40w3-total-cache&new=3585227%40w3-total-cache · Note
• https://twitter.com/CVEnew/status/2075869761699745861 · Twitter Post
• https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.9.4/Minify_Plugin.php#L132 · Note