https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 13:07:38 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-18051 <p>The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target name. On Apache, the same flaw overwrites the site&#39;s .htaccess files, which breaks the site and can strip hardening rules that other security measures rely on.</p> <p>The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target name. On Apache, the same flaw overwrites the site&#39;s .htaccess files, which breaks the site and can strip hardening rules that other security measures rely on.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-18051 https://vulnerability.circl.lu/vuln/ghsa-3qrw-968g-4hqv <p>The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target name. On Apache, the same flaw overwrites the site&#39;s .htaccess files, which breaks the site and can strip hardening rules that other security measures rely on.</p> <p>The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target name. On Apache, the same flaw overwrites the site&#39;s .htaccess files, which breaks the site and can strip hardening rules that other security measures rely on.</p> https://vulnerability.circl.lu/vuln/ghsa-3qrw-968g-4hqv