Blog W3 Total Cache 2.10.5 stops a pre-auth write to any file
W3 Total Cache 2.10.5 stops a pre-auth write to any file
W3 Total Cache 2.10.5 blocks an unauthenticated write to any file on the server, including .htaccess. Broken Link Checker 2.4.12 closes a pre-auth RCE. Elementor Pro, TrueBooker and TabaPay Gateway also shipped critical fixes.
W3 Total Cache 2.10.5 closes a serious bug. Any visitor can write a file anywhere the web server can reach. The plugin builds cache file names from the request path. It does not clean that path first. An attacker sends a crafted URL. The plugin writes into the file they choose. On Apache, the request overwrites the site’s .htaccess. That breaks the site or turns off security rules. The fix is 2.10.5. It matters on roughly 900,000 sites.
Five other plugins shipped critical fixes with the same shape. All six need no login. Broken Link Checker lets a visitor overwrite PHP globals and run code. Elementor Pro takes an arbitrary file upload from any request. TrueBooker hands over any account through one unauthenticated AJAX call. TabaPay Gateway does the same through a payment callback with no signature check.
w3-total-cache 2.10.5
The plugin uses the request path to build a cache file name. It does not strip .. or absolute segments. An unauthenticated attacker sends a request whose path points anywhere on disk. The plugin writes the response body to that location. On Apache the target is often the site’s .htaccess. Overwriting it turns off auth rules and mod_rewrite. It can also take the site offline. The plugin runs on roughly 900,000 sites.
- CVSS: 10.0
- CVE: CVE-2026-18051
- Affected: all versions before 2.10.5
- Patched in: 2.10.5
- After update: check
.htaccessin the site root and insidewp-adminandwp-content. Look for any file added or changed in the last few days that you did not put there.
broken-link-checker 2.4.12
On sites that use plain permalinks, the plugin reads query variables from the URL without a whitelist. An unauthenticated visitor overwrites arbitrary PHP globals. With a classic (non-block) theme active, that path reaches code execution. The plugin runs on roughly 500,000 sites.
- CVSS: 9.0
- CVE: CVE-2026-18937
- Affected: all versions before 2.4.12
- Patched in: 2.4.12
- After update: if the site uses plain permalinks and a classic theme, treat it as possibly compromised. Look for new PHP files under
wp-contentand unknown admin users.
elementor-pro 4.2.2
An unauthenticated file upload lets any visitor place a PHP file on the server and run it. The plugin is paid. The wordpress.org directory has no entry for the slug. Updates ship through the vendor’s own channel. Sites without auto-updates need to install 4.2.2 by hand.
- CVE:
CVE-2026-32475 - Patched in: 4.2.2
- After update: search
wp-content/uploadsfor.php,.phtmland.pharfiles. None of them belong there.
truebooker-appointment-booking 1.2.7
Two AJAX handlers in this booking plugin skip both the login check and the capability check. An unauthenticated attacker calls admin_user_create_cus with any user ID. The handler rewrites that user’s email address. From there, the password reset flow completes the takeover. Any account falls, including administrators, from one unauthenticated request.
- CVSS: 9.8 for each
- CVE: CVE-2026-18776, CVE-2026-18315
- Affected: all versions up to and including 1.2.6
- Patched in: 1.2.7
- After update: review admin user emails. Reset every admin password. Check the site log for recent password reset events.
tabapay-gateway up to 1.4.0, unpatched
The plugin’s payment callback does not check the signature. It opens a session for the account tied to the order. An unauthenticated request can name any registered user. The response is a valid session for that account, admin included. There is no fix yet. Sites that use this plugin should turn it off.
- CVSS: 9.8
- CVE: CVE-2026-18031
- Affected: all versions through 1.4.0
- Patched in: no fix yet
- What to do: deactivate the plugin. Rotate admin passwords and audit user accounts.
Tags: #wordpress , #plugin , #cve , #exploit