9.8 CVSS: 10Web Booster Vulnerability Enables Unauthenticated Remote Code Execution Up to Version 2.34.10

The 10Web Booster plugin for WordPress contains a critical security flaw that allows unauthenticated attackers to execute arbitrary code on affected servers. This vulnerability, tracked as CVE-2026-108587, affects all versions up to 2.34.10 and enables remote code execution without requiring user credentials.

The issue stems from an arbitrary file upload vulnerability within the plugin’s compressCustom function. According to the National Vulnerability Database, missing file type validation and extension filtering on the page_id parameter allow attackers to upload executable files. This is compounded by a security lapse where a REST nonce is leaked in a world-readable state.

Technical mechanics

The exploit chain relies on obtaining the plugin’s specific REST nonce, identified as tenwebio_rest. This nonce is automatically serialized to a file in the wp-content/uploads/ directory whenever a bulk optimization batch pauses. Because the nonce is generated in a cron or loopback context with a user ID of 0, it remains valid for unauthenticated visitors.

This combination of a leaked authentication token and insufficient input validation bypasses standard security checks. The National Vulnerability Database classifies this under CWE-434, which pertains to unrestricted upload of functionally executable file types. The result is full remote code execution capabilities for any attacker who discovers the affected endpoint.

Affected systems

Organizations using the 10Web Booster – Website speed optimization, Cache & Page Speed optimizer are at risk if they are running version 2.34.10 or any earlier release. The vulnerability is present across this entire version range. Site administrators must verify their current plugin version immediately to determine exposure.

Operational impact

When facing a critical remote code execution vulnerability, leadership should prioritize immediate containment and assessment. Teams usually need to verify which servers host the affected software and isolate those systems from the broader network to prevent lateral movement. Internal communications should inform IT and security staff of the specific risk, while legal and compliance teams review data exposure implications.

Managers should check whether external suppliers or partners have access to affected environments. It is essential to ensure that incident response plans are updated to reflect this threat vector. Stakeholders must be prepared for potential downtime if emergency patching or system rebuilding becomes necessary, impacting service delivery and customer trust.

Defender's checklist

Security teams should audit WordPress installations for the presence of the 10Web Booster plugin. Verify that no unauthorized files have been uploaded to the wp-content/uploads/ directory. Monitor server logs for unusual activity originating from unauthenticated sessions. Prepare for emergency maintenance windows to apply updates once they are available.

Background: Incident response plans

An incident response plan is a documented procedure for detecting, containing, and recovering from security breaches. It defines roles, communication channels, and technical steps to minimize damage, preserve evidence, and restore normal operations quickly.

Read the full guide: Incident Response Plans: Why Your Security Tools Fail Without One

What to do and how to stay safe: 10Web Booster

• Check your WordPress dashboard to confirm the installed version of the 10Web Booster plugin.
• Scan the wp-content/uploads/ directory for suspicious files that do not match expected content types.
• Monitor server access logs for requests attempting to use the compressCustom function or upload files.
• Once the vendor provides an update, apply it immediately to patch the arbitrary file upload vulnerability.

Step-by-step guide: Patch Management vs Vulnerability Management: The Critical Distinction

General security guidance from the InfoSec Ledger newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the severity rating of CVE-2026-108587?

The National Vulnerability Database rates this vulnerability as Critical with a CVSS score of 9.8.

Which versions of the 10Web Booster plugin are affected?

All versions up to and including 2.34.10 are vulnerable to this arbitrary file upload flaw.

How does the attacker bypass authentication checks?

Attackers exploit a world-readable leaked nonce (tenwebio_rest) that is valid for unauthenticated visitors.