The W3 Total Cache plugin for WordPress contains an information exposure vulnerability (CWE-200) in all versions up to and including 2.8.1. When the debug feature is enabled, a debug log file is publicly accessible without authentication. This log file may contain sensitive data such as nonce values, which could be leveraged in subsequent attacks like Cross-Site Request Forgery (CSRF). Since the debug mode is disabled by default, the risk is limited to environments where debugging is explicitly enabled. No known exploits are reported in the wild as of the publication date.

An unauthenticated attacker can access sensitive information through the exposed debug log file, potentially compromising nonce values used for security tokens. This exposure could enable further attacks such as CSRF. However, the impact is limited because the debug feature must be enabled for the vulnerability to be exploitable, and it is disabled by default. There is no impact on integrity or availability reported.

Since no official patch or fix is currently documented, the primary mitigation is to ensure that the debug feature in W3 Total Cache is disabled, which is the default setting. Administrators should verify that debug logging is not publicly accessible on their WordPress installations. Monitor vendor advisories for any forthcoming patches or updates addressing this vulnerability.