CVE-2026-108587
Received Received - Intake

Arbitrary File Upload in 10Web Booster WordPress Plugin

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Wordfence

Description
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the page_id parameter, combined with a world-readable leaked nonce that bypasses authentication checks. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. This exploit chain requires obtaining the plugin's REST nonce (tenwebio_rest), which is automatically serialized to a world-readable file under wp-content/uploads/ whenever a bulk optimisation batch pauses; because the nonce is generated in a cron/loopback context with a user ID of 0, it is valid for unauthenticated visitors.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-108587
EUVD
EUVD-2026-101824

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
10web 10Web Booster – Website speed optimization, Cache & Page Speed optimizer 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the 10Web Booster WordPress plugin up to version 2.34.10. It allows unauthenticated attackers to upload arbitrary files due to missing file type validation and a leaked authentication nonce. The nonce is stored in a world-readable file during bulk optimization pauses, enabling remote code execution.

Detection Guidance

Check for unauthorized file uploads in wp-content/uploads/ with executable extensions like .php. Review server logs for suspicious REST API requests to the compressCustom function. Use commands like 'find /path/to/uploads -type f -name "*.php"' to locate unexpected files.

Impact Analysis

Attackers could upload malicious executable files to your WordPress site, leading to remote code execution. This could allow full control over your website, data theft, or further attacks against visitors.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR (data protection) and HIPAA (health data security) requirements. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Update the 10Web Booster plugin to the latest version beyond 2.34.10. Remove any unauthorized files in upload directories. Restrict file upload permissions and disable world-readable nonce files. Monitor for signs of exploitation like unexpected processes or network connections.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108587. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart