The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The W3 Total Cache WordPress plugin before 2.10.6 does not confine a media-import file copy to the document root, nor enforce an effective file-type restriction on it, allowing users with the Author role or higher to plant content that, once an administrator runs the import, copies an arbitrary server-readable file into a publicly served directory, exposing it to unauthenticated retrieval.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| W3 Total Cache Plugin | — | Update w3-total-cache plugin to version 2.10.6, or a newer patched version | Oct 30, 2026 | Oct 8, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub