Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

10Web Booster allows anyone to upload files

CVE-2026-108587 · published 19 days ago
Summary

All versions of the 10Web Booster plugin for WordPress up to 2.34.10 let unauthenticated users upload files through a missing check on the page_id parameter. Attackers can place malicious code on the site and potentially take control. Update the plugin to a newer version or remove it until it is patched, and restrict file uploads to trusted users.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
10web 10web booster – website speed optimization, cache & page speed optimizer <= 2.34.10
Original advisory text
10Web Booster <= 2.34.10 - Unauthenticated Arbitrary File Upload via 'page_id' Parameter
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the page_id parameter, combined with a world-readable leaked nonce that bypasses authentication checks. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. This exploit chain requires obtaining the plugin's REST nonce (tenwebio_rest), which is automatically serialized to a world-readable file under wp-content/uploads/ whenever a bulk optimisation batch pauses; because the nonce is generated in a cron/loopback context with a user ID of 0, it is valid for unauthenticated visitors.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-434Unrestricted File Upload
Timeline
Published15 Oct 2026
Updated3 Nov 2026
First seen15 Oct 2026
Sources
CVE-2026-108587 · NVD
CVE-2026-108587 · MITRE
Track software like this
Free during beta