CVE-2026-9282 boldgrid CVE debrief

Who should care

Users of the W3 Total Cache plugin for WordPress, particularly those with versions up to and including 2.9.4, should be aware of this vulnerability and take immediate action to protect their sites. This includes updating the plugin to a version beyond 2.9.4, restricting access to sensitive files and directories, and monitoring server logs for suspicious file access attempts.

Technical summary

The vulnerability exists in the setupSources function of the W3 Total Cache plugin. An unauthenticated attacker can exploit this by enabling manual minify mode and supplying a manual-format minify filename, allowing them to read arbitrary files on the server. The vulnerability is caused by a lack of proper input validation, which enables attackers to traverse the directory structure and access sensitive files.

Defensive priority

High

Recommended defensive actions

• Update the W3 Total Cache plugin to a version beyond 2.9.4
• Restrict access to sensitive files and directories
• Monitor server logs for suspicious file access attempts
• Consider implementing additional security measures such as web application firewalls
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-11T07:16:47.070Z and has not been modified since then. The NVD entry is currently Received. The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires enabling manual minify mode and supplying a manual-format minify filename so that the hash is empty and the f_array[] entries are not overwritten before reaching setupSources().

Official resources