CVE-2026-108587 Details
Description
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the page_id parameter, combined with a world-readable leaked nonce that bypasses authentication checks. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. This exploit chain requires obtaining the plugin's REST nonce (tenwebio_rest), which is automatically serialized to a world-readable file under wp-content/uploads/ whenever a bulk optimisation batch pauses; because the nonce is generated in a cron/loopback context with a user ID of 0, it is valid for unauthenticated visitors.
A vulnerability allowing arbitrary file upload has been identified in the 10Web Booster plugin for WordPress, in all versions through 2.34.10. The issue arises in the compressCustom function, where there is a lack of proper file type validation and extension filtering on the page_id parameter. This vulnerability is compounded by a leaked nonce that is world-readable, bypassing authentication checks. As a result, unauthenticated attackers can upload potentially executable files, leading to remote code execution. Exploitation requires obtaining the plugin's REST nonce (tenwebio_rest), which is automatically saved to a world-readable file in wp-content/uploads/ whenever a bulk optimization batch is paused. Since the nonce is generated with a user ID of 0 in a cron/loopback context, it remains valid for unauthenticated visitors.
Users are advised to update the 10Web Booster plugin to version 2.34.11 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| 10Web Booster | <= 2.34.10 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |