CVE-2026-103896
Received Received - Intake

Path Traversal in 10Web Booster WordPress Plugin

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Wordfence

Description
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::get_cache_file_dir() function concatenating raw, unsanitized $_GET parameter names and values into the on-disk cache path, and the cache_content() sink calling mkdir() and file_put_contents() on the result with no realpath containment check — unlike the sibling delete_page_cache(), which does perform one. This makes it possible for unauthenticated attackers to create arbitrary directories (mode 0777, recursively) outside the cache root and write a cached page into them. The write is LIMITED: the filename is always 'source.html', so the extension is fixed, and the content is the rendered page buffer rather than attacker-supplied data. PHP files cannot be written and code execution is not possible; the demonstrated impact is cache poisoning and arbitrary directory creation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-103896
EUVD
EUVD-2026-102671

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
10web 10Web Booster – Website speed optimization, Cache & Page Speed optimizer 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-103896 is a path traversal vulnerability in the 10Web Booster WordPress plugin up to version 2.34.5. It allows unauthenticated attackers to create arbitrary directories outside the cache root and write a file named 'source.html' with the rendered page content. The attack is limited as PHP files cannot be written and code execution is not possible.

Detection Guidance

Check for unexpected directories named 'source.html' outside the cache root or directories with 0777 permissions. Inspect web server logs for unusual GET parameter patterns like '?page=../../../../../etc/' leading to file writes.

Impact Analysis

This vulnerability could allow attackers to poison the cache by injecting arbitrary HTML content into 'source.html' files. This may lead to defacement, misleading content delivery, or disruption of website functionality. Attackers could also create unintended directories on the server.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized file writes outside intended directories. Arbitrary directory creation and cache poisoning may lead to data integrity issues or unauthorized access to cached content, which could expose sensitive information. However, the limited write capability (fixed filename and non-executable content) reduces but does not eliminate risks to compliance.

Mitigation Strategies

Update the 10Web Booster plugin to the latest version beyond 2.34.5. Temporarily disable the plugin if an update is unavailable. Monitor for unauthorized directory creation or cache poisoning attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103896. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart