CVE-2026-82195
Received Received - Intake

Authentication Bypass in 10Web Booster WordPress Plugin

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: WPScan

Description
The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud connection, disclosing that secret to unauthenticated visitors and letting them delete it repeatedly, preventing an administrator from completing a legitimate connection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-82195
EUVD
EUVD-2026-85797

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
10web booster to 2.34.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The 10Web Booster WordPress plugin before version 2.34.0 has a vulnerability where unauthenticated users can access and disclose a shared secret used for cloud connection authentication. This allows attackers to repeatedly delete the secret, preventing administrators from establishing legitimate connections.

Detection Guidance

Check if the 10Web Booster WordPress plugin version is below 2.34.0. Inspect network traffic for unauthenticated requests to the shared secret endpoint. Use WordPress admin panel to verify plugin version and settings.

Impact Analysis

This vulnerability could allow unauthorized users to disrupt your WordPress site's connection to 10Web's cloud services. Attackers might repeatedly delete the authentication secret, making it impossible for you to connect your site to the cloud, potentially affecting performance or functionality.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing authentication secrets used for cloud connections. Unauthorized access to shared secrets may lead to unauthorized data access or modifications, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Update the 10Web Booster plugin to version 2.34.0 or later immediately. Remove any exposed shared secrets and regenerate them after updating. Monitor for unauthorized access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82195. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart