IT SBIT Services
Schneeberger
DEEN
CVE tracker

10Web Booster: Unauthenticated arbitrary file upload leading to remote code execution

CVE-2026-108587Critical 9.8

← All vulnerabilities

Summary

The 10Web Booster WordPress plugin (speed optimization, caching and image optimization) up to and including version 2.34.10 does not validate file types or extensions in the compressCustom function. A REST nonce that the plugin writes to a world-readable file under wp-content/uploads/ when a bulk optimization batch pauses can be reused by unauthenticated visitors, so an attacker can upload files that may be executable. This can lead to remote code execution on the web server.

Affected

  • 10Web Booster (slug tenweb-speed-optimizer) all versions up to and including 2.34.10
  • Default configuration: unaffected

Fixed in

  • Version 2.34.11 (WordPress.org changelog: security hardening in the image optimization queue and REST API; the CVE is not named there)

Workaround

  • Deactivate and uninstall the plugin if an update is not possible.
  • Restrict access to the plugin's upload paths and monitor for unusual HTTP requests targeting them.

Exploitation

  • CVSS 9.8 (CRITICAL), network-reachable, low complexity, no privileges and no user interaction required.
  • CISA SSVC: automatable yes, technical impact total; exploitation status 'none'.
  • Not listed in CISA KEV.
  • A public proof of concept was not found in the research; this is unconfirmed rather than absent.

Our recommendation

  • Update the plugin to version 2.34.11 or later on all WordPress sites.
  • If an update is not possible, deactivate and uninstall the plugin.
  • Check wp-content/uploads/ and the plugin directory for unexpected PHP or other executable files on sites that ran an affected version.
  • Check for and remove any world-readable serialized files created by the plugin under wp-content/uploads/.
  • Monitor web server logs for unusual requests to upload endpoints.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:53.

Original description (NVD)

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the page_id parameter, combined with a world-readable leaked nonce that bypasses authentication checks. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. This exploit chain requires obtaining the plugin's REST nonce (tenwebio_rest), which is automatically serialized to a world-readable file under wp-content/uploads/ whenever a bulk optimisation batch pauses; because the nonce is generated in a cron/loopback context with a user ID of 0, it is valid for unauthenticated visitors.

NVD references (12)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed