Read the docs
TI-2026-74586 Aliases CVE-2026-108587GHSA-38rr-wcwh-jgw6

Unauthenticated file upload in 10Web Booster WordPress plugin

Priority MEDIUM 51CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

The 10Web Booster WordPress plugin up to and including 2.34.10 has an arbitrary file upload flaw in the compressCustom function. Missing file type validation and extension filtering (CWE-434) let an unauthenticated attacker upload files that may be executable, which can lead to remote code execution. A world-readable nonce stored under wp-content/uploads/ lets unauthenticated visitors pass authentication checks.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the page_id parameter, combined with a world-readable leaked nonce that bypasses authentication checks. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. This exploit chain requires obtaining the plugin's REST nonce (tenwebio_rest), which is automatically serialized to a world-readable file under wp-content/uploads/ whenever a bulk optimisation batch pauses; because the nonce is generated in a cron/loopback context with a user ID of 0, it is valid for unauthenticated visitors.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00916 60th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
10web10Web Booster – Website speed optimization, Cache & Page Speed optimizerup to 2.34.10—No fix listedCNA
  • 10Web Booster – Website speed optimization, Cache & Page Speed optimizer Vendor10web Affected up to 2.34.10 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for 10Web Booster.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-15 Threatist record created from CVE-2026-108587
  2. 2026-10-15 CISA SSVC decision points changed
  3. 2026-10-16 Alias added: GHSA-38rr-wcwh-jgw6

References

Other 12

  • TI-2023-04299 Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload CVSS 3.1CRITICAL 9.8
  • TI-2023-00035 10WebMapBuilder < 1.0.73 - Unauthenticated SQLi CVSS 3.1CRITICAL 9.8
  • TI-2022-00110 Photo Gallery by 10Web < 1.6.0 - Unauthenticated SQL Injection CVSS 3.1CRITICAL 9.8
  • TI-2022-01165 Photo Gallery < 1.6.3 - Unauthenticated SQL Injection CVSS 3.1CRITICAL 9.8
  • TI-2014-07554 Unrestricted File Upload vulnerability in Photo Gallery 1.2.5. CVSS 3.0HIGH 8.8
  • TI-2018-15571 WordPress Form Maker Plugin 1.12.24 SQL Injection via admin-ajax.php CVSS 4.0HIGH 7.1
See all 147 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences