CVE-2026-9282
HIGH EXPLOITED NUCLEIW3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter
Title source: cnaExploitation Summary
CVE-2026-9282 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including incogbyte. A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit demonstrates an unauthenticated arbitrary file read vulnerability in W3 Total Cache <= 2.9.4 via the `f_array` parameter in the minify request handler. The PoC reads sensitive files like `wp-config.php` by leveraging improper input validation in manual-mode minify group processing.
Description
The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires enabling manual minify mode and supplying a manual-format minify filename so that the hash is empty and the f_array[] entries are not overwritten before reaching setupSources().
Exploits (1)
This exploit demonstrates an unauthenticated arbitrary file read vulnerability in W3 Total Cache <= 2.9.4 via the `f_array` parameter in the minify request handler. The PoC reads sensitive files like `wp-config.php` by leveraging improper input validation in manual-mode minify group processing.
Nuclei Templates (1)
http.html:"w3-total-cache"
body="/wp-content/plugins/w3-total-cache/"
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N