Unauthenticated path traversal in BoldGrid W3 Total Cache enables unintended path access

Unauthenticated Path Traversal in W3 Total Cache <= 2.10.2 versions.

• Product: the BoldGrid W3 Total Cache WordPress plugin, package w3-total-cache.
• Affected branch: versions <= 2.10.2.
• The record marks the status as unaffected at version 2.10.3.
• The affected data has a default status of unaffected; the confirmed scope is limited to the product and branch listed above.

BoldGrid W3 Total Cache contains a Path Traversal flaw classified as CWE-35. The flaw allows an unauthenticated network request to provide path data that may cause path handling to escape the intended directory; Patchstack describes the possibility of escaping the website directory and reaching private files stored elsewhere on the server.

The record confirms network reachability, no required privileges, no user interaction, and low attack complexity. However, the public evidence does not identify the endpoint, parameter, file operation, or implementation detail responsible for the flaw. The record therefore does not establish arbitrary code execution, unrestricted file disclosure, or full server compromise.

The flaw is remotely reachable over the network and does not require authentication or user interaction. The supplied record also characterizes exploitation complexity as low.

The record does not report a public exploit and does not mark the vulnerability as known exploited. The CISA enrichment displayed in the GCVE data records exploitation as none at its assessment time; this does not prove that exploitation is impossible or absent from every environment. The specific endpoint, parameter, and exploit request sequence have not been established by the available evidence.

An unauthenticated remote attacker may influence the plugin's path resolution without user interaction. The recorded technical outcome is limited impact to integrity and availability within the same security scope; the record does not establish arbitrary code execution, server takeover, or specific data disclosure.

The practical result depends on the web process permissions, server configuration, and files reachable by the plugin. Because the endpoint, parameter, and file operation are not publicly identified, the evidence does not support concluding that every deployment permits reading, writing, or deleting files.

The flaw creates risk for internet-facing WordPress sites because an unauthenticated user may send requests to the vulnerable component. Possible consequences include access to paths outside the intended scope, file changes, or partial service disruption, depending on the web process permissions and the plugin's path handling.

Patchstack describes the possibility of escaping the website directory and reaching private files elsewhere on the server, but the normalized record does not establish data disclosure in a particular deployment. The available evidence does not identify a campaign, victim, or confirmed compromise.

1. Update the WordPress W3 Total Cache plugin to version 2.10.3, which the record and Patchstack identify as patched.
2. The supplied solution also recommends the latest available version, with a minimum of 2.10.3; verify the installed version on every site after updating.
3. If an immediate update is not possible, apply the Patchstack mitigation rule described in the advisory to block attack attempts during the transition. Treat this as temporary protection, not a replacement for updating.
4. After remediation, review logs and file integrity to identify possible traversal requests or unexpected changes that occurred before the update.

1. Inventory all WordPress sites and identify installations containing the w3-total-cache package.
2. Compare each installed plugin version with the affected branch and verify that the patched release has been deployed.
3. Review HTTP, reverse proxy, and WAF logs for traversal-like requests targeting WordPress or plugin URLs. This is precautionary monitoring, not a confirmed indicator of compromise.
4. Review for unexpected file changes inside or outside the website directory, especially where suspicious traversal requests are present. The record does not provide a specific endpoint, parameter, or log signature, and the absence of matching log evidence does not prove that a system is safe.