# CVE-2026-18051: W3 Total Cache - Path Traversal

> Live exploitation tracking for CVE-2026-18051 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-18051

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 10.0
- **Public exploit available:** Yes
- **Affected products:** Boldgrid W3 Total Cache
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
- **Tags:** wordpress, cms

## Description

The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target name.
On Apache, the same flaw overwrites the site's .htaccess files, which breaks the site and can strip hardening rules that other security measures rely on.

## CrowdSec analysis

[CVE-2026-18051](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-18051) is a critical path traversal vulnerability in the W3 Total Cache WordPress plugin before version 2.10.5. Unauthenticated attackers can exploit improper request-path validation to write or overwrite files in existing server directories, including files outside the web root. On Apache servers, this can overwrite `.htaccess` files, disrupting site availability and removing security rules that other protections rely on.

CrowdSec has been tracking this vulnerability and its exploits since 27th of October 2026.

Data from the CrowdSec community indicates that exploitation of CVE-2026-18051 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations.
Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2026-18051. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Attackers target WordPress search URLs under `/search/`, using encoded `..\\` traversal sequences to manipulate cache file paths and write files. Successful exploitation may overwrite files such as `.htaccess`.

## Timeline

- 2026-08-19: CVE Published. CVE-2026-18051 is published to NVD.
- 2026-10-27: Rule Released. CrowdSec releases a rule to detect CVE-2026-18051 exploitation attempts against the CrowdSec Network.
- 2026-10-28: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-18051 for the first time.

## References

- https://wpscan.com/vulnerability/dc56cdd2-419b-4a64-9d2a-29dc7e79cb6d/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-18051.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-18051) follows observed exploitation activity for CVE-2026-18051. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.