CVE-2026-103896 10web CVE debrief

Who should care

Defenders responsible for WordPress installations using the 10Web Booster plugin, especially those concerned with cache management and directory structure integrity, should assess exposure and potential impact. This vulnerability may affect sites relying on caching for performance optimization.

Why it matters

This vulnerability in the 10Web Booster plugin for WordPress allows unauthenticated attackers to create arbitrary directories and write cached pages into them, with limitations. Defenders should verify exposure, assess impact, and prioritize remediation or compensating controls to prevent cache poisoning and directory creation.

• Cache poisoning, potentially affecting site performance and content delivery.
• Arbitrary directory creation, which could lead to further exploitation or system inconsistencies.
• Potential for denial-of-service through cache saturation or directory creation leading to storage issues.
• Verification of cache integrity and directory structure may be necessary to ensure system security and performance.

Technical summary

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5. This is due to the OptimizerWebPageCache::get_cache_file_dir() function concatenating raw, unsanitized $_GET parameter names and values into the on-disk cache path, and the cache_content() sink calling mkdir() and file_put_contents() on the result with no realpath containment check. The write is limited: the filename is always 'source.html', so the extension is fixed, and the content is the rendered page buffer rather than attacker-supplied data. PHP files cannot be written and code execution is not possible; the demonstrated impact is cache poisoning and arbitrary directory creation.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially those using the affected plugin versions.

Recommended defensive actions

• Verify if the 10Web Booster plugin version 2.34.5 or earlier is installed and in use.
• Assess the potential impact of cache poisoning and arbitrary directory creation on the system.
• Consider updating to a patched version if available, or applying compensating controls to limit the vulnerability's impact.
• Monitor for any suspicious activity related to cache poisoning or directory creation.
• Perform a thorough review of system logs to identify potential security incidents.
• Implement additional monitoring to detect unusual cache or directory changes.
• Review and update incident response plans to address potential exploitation of this vulnerability.

Evidence notes

The CVE record and source details indicate a limited file write vulnerability via path traversal in the 10Web Booster plugin. The issue is due to unsanitized use of $_GET parameters in the OptimizerWebPageCache::get_cache_file_dir() function and lack of realpath containment checks in the cache_content() function. The impact is limited to cache poisoning and directory creation, not code execution or arbitrary file writes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.