10Web Booster: PHP Object Injection by authenticated Contributor users
Summary
The WordPress plugin 10Web Booster (Website speed optimization, Cache & Page Speed optimizer) in versions up to and including 2.33.6 contains a PHP Object Injection vulnerability (CWE-502). An attacker with a Contributor account can submit crafted serialized data that the plugin processes unsafely. Depending on the code available on the site, this can lead to manipulation of data or execution of harmful actions on the server. The risk is highest on sites with open user registration or many contributor accounts.
Affected
- 10Web Booster (WordPress plugin, slug tenweb-speed-optimizer) versions up to and including 2.33.6
Fixed in
- Fixed in version 2.34.0 according to the CNA record and Patchstack.
- The latest available version should be installed (2.34.11 at the time of research).
Workaround
- No vendor workaround known.
- Limit Contributor and higher accounts to trusted users until the plugin is updated.
Exploitation
- No evidence of exploitation in the wild found.
- CISA SSVC: exploitation none, automatable no.
- Patchstack expects exploitation and rates the issue as medium priority.
- No public proof of concept found.
Our recommendation
- Update the 10Web Booster plugin to version 2.34.0 or later, preferably the latest release.
- Check which WordPress accounts have Contributor or higher roles and remove unneeded accounts.
- Disable open user registration if it is not required.
- Monitor the site for unexpected changes and review the installed plugin version.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- Strix CVE record www.strix.ai
- WPScan plugin page wpscan.com
- WordPress.org plugin page (changelog) wordpress.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:12.
Original description (NVD)
Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.