CVE-2026-107321: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in W3 Total Cache

The W3 Total Cache WordPress plugin prior to version 2.10.6 does not properly restrict the pathname of files during a media-import file copy operation. It fails to confine the copied file to the document root and does not enforce effective file-type restrictions. Consequently, users with Author role or higher can plant content that, upon an administrator executing the import, results in arbitrary server-readable files being copied into a publicly served directory. This exposure allows unauthenticated retrieval of potentially sensitive files.

This vulnerability can lead to unauthorized disclosure of sensitive server files to unauthenticated users. The exposure depends on the presence of readable files on the server and the ability of an attacker to induce an administrator to run the import process. It does not directly allow code execution but can compromise confidentiality.

Upgrade the W3 Total Cache plugin to version 2.10.6 or later, where this vulnerability is fixed. Until then, restrict Author role permissions to prevent untrusted users from planting malicious content, and avoid running media imports from untrusted sources. Patch status is not explicitly confirmed in vendor advisories; therefore, check the official plugin release notes or vendor advisory for the latest remediation guidance.