The vulnerability CVE-2026-27384 affects BoldGrid's W3 Total Cache plugin versions up to and including 2.9.1. It arises from improper validation of input quantities, which results in access to functionality that should be restricted by ACLs but is not. This can lead to unauthorized actions with critical impact on system security. The CVSS 3.1 base score is 9.0, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability.

Successful exploitation could allow an unauthenticated attacker to bypass access controls and perform unauthorized actions within the affected plugin, potentially resulting in full compromise of the affected system's confidentiality, integrity, and availability. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for unusual activity. Avoid deploying the affected versions in high-risk environments if possible.