W3 Total Cache: unauthenticated arbitrary file write (CVE-2026-18051)
A vulnerability, CVE-2026-18051 (CVSS 10), was published for the W3 Total Cache WordPress plugin. The plugin does not properly validate the request path it uses to build cache file names.
Checked in Shield: no
Who is affected
WordPress sites running W3 Total Cache before 2.10.5. An unauthenticated attacker can write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target name.
How to check
In the WordPress admin, open the Plugins page and check the W3 Total Cache version. If it is below 2.10.5, the site is affected. On Apache, also check whether your .htaccess files have been changed.
How to fix
A patch is available: update W3 Total Cache to 2.10.5 or later. On Apache the flaw overwrites .htaccess files, which breaks the site and can strip hardening rules, so review those files after updating.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
It is not yet disclosed whether the flaw is exploited in the wild. Source: NVD.
