# W3 Total Cache <= 2.10.7 - Unauthenticated Minify Cache Poisoning via 'b' Parameter and Query String

- **ID:** WPSEC-2026-1411
- **Plugin:** W3 Total Cache (`w3-total-cache`), https://wordpress.org/plugins/w3-total-cache/
- **Affected versions:** all versions before 2.11.0
- **Fixed in:** 2.11.0 (Update to 2.11.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-73
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/w3-total-cache
- **Fix released:** 2026-10-20
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1411/

## Description

The W3 Total Cache plugin for WordPress is vulnerable to minify cache poisoning in all versions up to, and including, 2.10.7. In auto minify mode, public minified file requests accepted a query string on the file name, kept the request's 'b' (base) parameter, and derived the cache ID from the raw requested name. The base parameter could reroot the stored document-root-relative file list, and nothing stopped sources from inside the minify cache directory being used. This makes it possible for unauthenticated attackers to make the minifier build cached CSS/JS artifacts from files other than the intended ones, poisoning or misdirecting the minified assets served to site visitors.

## References

- https://wpsec.com/vuln/WPSEC-2026-1411/
- https://plugins.svn.wordpress.org/w3-total-cache/tags/2.11.0/
- https://wordpress.org/plugins/w3-total-cache/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1411/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.