Insufficient File-Type Restriction in W3 Total Cache WordPress Plugin by W3 EDGE
CVE-2026-107321
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 10 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-107321?
The W3 Total Cache plugin for WordPress prior to version 2.10.6 fails to properly constrain media-import file operations. This vulnerability allows users with the Author role or higher to upload files that can be executed when triggered by an admin. The lack of adequate file-type checks and confinement to the document root means that potentially harmful files can be copied to publicly accessible directories, leading to security breaches and unauthorized access to sensitive data.
Affected Version(s)
W3 Total Cache 0 < 2.10.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.