10Web Booster Plugin Flaw Allows Unauthenticated Remote Code Execution

The 10Web Booster plugin for WordPress contains a critical security flaw that allows attackers to execute remote code on vulnerable websites. The National Vulnerability Database lists this issue as CVE-2026-108587, assigning it a CVSS score of 9.8. This high severity rating reflects the ease with which an unauthenticated attacker can compromise the server hosting the affected WordPress installation.

The vulnerability stems from missing file type validation and extension filtering within the plugin’s compressCustom function. Attackers can exploit this weakness by targeting the page_id parameter. Because the plugin fails to properly restrict uploaded files, an attacker can submit executable content. This arbitrary file upload capability serves as the primary vector for achieving remote code execution on the target system.

Context and Background

The exploit chain relies on a specific authentication bypass involving a leaked REST API nonce. According to the NVD record, the plugin automatically serializes the tenwebio_rest nonce to a world-readable file located in the wp-content/uploads directory. This serialization occurs whenever a bulk optimization batch pauses during its execution cycle. The nonce is generated in a cron or loopback context with a user ID of zero.

Because the nonce is generated with this specific user ID, it remains valid for unauthenticated visitors. This design flaw effectively bypasses standard authentication checks that would normally protect administrative or sensitive functions. An attacker can retrieve the nonce from the publicly accessible file and use it to authorize malicious requests. This combination of a leaked credential and insufficient input validation creates the conditions for the exploit.

Who is affected

All versions of the 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin up to and including version 2.34.10 are vulnerable to this attack. The plugin is designed to optimize website speed and manage cache settings for WordPress sites. Any site running an affected version of this plugin is potentially exposed to the described arbitrary file upload vulnerability.

The impact is significant because the attacker does not need valid login credentials to initiate the exploit. The presence of the world-readable nonce file is sufficient to grant the necessary permissions for file upload. Site administrators using versions prior to the next release after 2.34.10 should consider their installations at risk until a fix is confirmed.

What should you do?

Security teams should immediately audit their WordPress installations for the presence of the 10Web Booster plugin. If the plugin is installed, administrators must verify the current version against the affected list. Monitoring server logs for unusual file uploads or requests to the compressCustom function can help detect active exploitation attempts.