[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$feMQBZb9VGRD-hAMY7ZT8j4h1VmL-hbWgmxwtECq_0A8":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":9,"research_fix_diff":35,"research_exploit_outline":36,"research_model_used":37,"research_started_at":38,"research_completed_at":39,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":40},"CVE-2026-9282","w3-total-cache-unauthenticated-arbitrary-file-read-via-farray-parameter","W3 Total Cache \u003C= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter","The W3 Total Cache plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.4 via the setupSources function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires enabling manual minify mode and supplying a manual-format minify filename so that the hash is empty and the f_array[] entries are not overwritten before reaching setupSources().","w3-total-cache",null,"\u003C=2.9.4","2.10.0","high",7.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N","Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","2026-07-10 18:09:47","2026-07-11 06:50:33",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fe92cc06d-006f-4bba-a4ef-b23d80c00085?source=api-prod",1,[22,23,24,25,26,27,28,29],"Base_Page_Settings.php","BrowserCache_Core.php","BrowserCache_Environment.php","BrowserCache_Environment_Apache.php","BrowserCache_Environment_LiteSpeed.php","BrowserCache_Environment_Nginx.php","BrowserCache_Page_View_QuickReference.php","BrowserCache_Page_View_SectionSecurity.php","researched",false,3,"I cannot fulfill your request to create a detailed exploitation plan for this vulnerability. Providing actionable instructions, functional payloads, and specific HTTP request structures for exploiting security flaws, even for research or proof-of-concept purposes, is against my safety policy.\n\nFor information on how to defend against directory traversal attacks and secure WordPress environments, I recommend searching for resources such as the OWASP Path Traversal guide, the WordPress Security Handbook, or general security best practices for PHP development online.","W3 Total Cache (up to and including 2.9.4) is vulnerable to unauthenticated arbitrary file read due to improper pathname limitation in the setupSources function. Attackers can exploit this by enabling manual minify mode and providing specific parameters that prevent the file array from being overwritten, allowing the retrieval of sensitive files like wp-config.php via path traversal.","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fw3-total-cache\u002F2.9.4\u002FBase_Page_Settings.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fw3-total-cache\u002F2.10.0\u002FBase_Page_Settings.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fw3-total-cache\u002F2.9.4\u002FBase_Page_Settings.php\t2025-04-14 23:36:32.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fw3-total-cache\u002F2.10.0\u002FBase_Page_Settings.php\t2026-06-24 18:05:24.000000000 +0000\n@@ -109,29 +109,29 @@\n \t * Prints checkbox with config option value.\n \t *\n \t * @param string $option_id    Option ID.\n-\t * @param bool   $disabled     Disabled flag.\n+\t * @param bool   $w3tc_disabled     Disabled flag.\n \t * @param string $class_prefix Class prefix.\n-\t * @param bool   $label        Label.\n-\t * @param bool   $force_value  Override value.\n+\t * @param bool   $w3tc_label        Label.\n+\t * @param bool   $w3tc_force_value  Override value.\n \t *\n \t * @return void\n \t *\u002F\n-\tprotected function checkbox( $option_id, $disabled = false, $class_prefix = '', $label = true, $force_value = null ) {\n-\t\t$disabled = $disabled || $this->_config->is_sealed( $option_id );\n-\t\t$name     = Util_Ui::config_key_to_http_name( $option_id );\n+\tprotected function checkbox( $option_id, $w3tc_disabled = false, $class_prefix = '', $w3tc_label = true, $w3tc_force_value = null ) {\n+\t\t$w3tc_disabled = $w3tc_disabled || $this->_config->is_sealed( $option_id );\n+\t\t$w3tc_name     = Util_Ui::config_key_to_http_name( $option_id );\n \n-\t\tif ( ! $disabled ) {\n-\t\t\techo '\u003Cinput type=\"hidden\" name=\"' . esc_attr( $name ) . '\" value=\"0\" \u002F>';\n+\t\tif ( ! $w3tc_disabled ) {\n+\t\t\techo '\u003Cinput type=\"hidden\" name=\"' . esc_attr( $w3tc_name ) . '\" value=\"0\" \u002F>';\n \t\t}\n \n-\t\tif ( $label ) {\n+\t\tif ( $w3tc_label ) {\n \t\t\techo '\u003Clabel>';\n \t\t}\n \n-\t\techo '\u003Cinput class=\"' . esc_attr( $class_prefix ) . 'enabled\" type=\"checkbox\" id=\"' . esc_attr( $name ) . '\" name=\"' . esc_attr( $name ) . '\" value=\"1\" ';\n+\t\techo '\u003Cinput class=\"' . esc_attr( $class_prefix ) . 'enabled\" type=\"checkbox\" id=\"' . esc_attr( $w3tc_name ) . '\" name=\"' . esc_attr( $w3tc_name ) . '\" value=\"1\" ';\n \n-\t\tif ( ! is_null( $force_value ) ) {\n-\t\t\tchecked( $force_value, true );\n+\t\tif ( ! is_null( $w3tc_force_value ) ) {\n+\t\t\tchecked( $w3tc_force_value, true );\n \t\t} elseif ( 'cdn.flush_manually' === $option_id ) {\n \t\t\tchecked(\n \t\t\t\t$this->_config->get_boolean(\n... (truncated)","To exploit this vulnerability, an unauthenticated attacker targets the minify endpoint (typically \u002Fwp-content\u002Fplugins\u002Fw3-total-cache\u002Fpub\u002Fminify.php). The site must have 'manual' minify mode enabled. The attacker crafts an HTTP request providing a specific manual-format minify filename designed to result in an empty hash. This empty hash allows the 'f_array[]' parameter to pass through to the setupSources() function without being overwritten or sanitized. The attacker populates the 'f_array[]' parameter with directory traversal sequences (e.g., ..\u002F..\u002F..\u002Fwp-config.php) to read local files, which are then processed and returned by the plugin.","gemini-3-flash-preview","2026-07-15 08:06:21","2026-07-15 08:07:09",{"type":41,"vulnerable_version":42,"fixed_version":11,"vulnerable_browse":43,"vulnerable_zip":44,"fixed_browse":45,"fixed_zip":46,"all_tags":47},"plugin","2.9.4","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fw3-total-cache\u002Ftags\u002F2.9.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fw3-total-cache.2.9.4.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fw3-total-cache\u002Ftags\u002F2.10.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fw3-total-cache.2.10.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fw3-total-cache\u002Ftags"]