This vulnerability (CVE-2026-66695) is a CWE-35 path traversal issue in the W3 Total Cache plugin by BoldGrid, affecting versions up to 2.10.2. It can be exploited without authentication, enabling an attacker to traverse directories using crafted path sequences such as '.../...//'. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, but limited integrity and availability impacts. There is no vendor advisory or patch information available at this time.

The vulnerability allows unauthenticated attackers to perform path traversal, which may lead to limited integrity and availability impacts on affected systems. Confidentiality is not impacted. The attack can be performed remotely without any privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the plugin and monitoring for suspicious activity related to path traversal attempts.