CVE-2026-108587 10web CVE debrief

Who should care

WordPress site administrators and security teams should verify exposure and apply patches. They should also review system logs for potential exploitation attempts and monitor for suspicious file uploads and system changes. Additionally, they should check for the presence of the leaked nonce file under wp-content/uploads/ and verify if the 10Web Booster plugin is installed and if the version is 2.34.10 or earlier. This vulnerability allows unauthenticated

Why it matters

The 10Web Booster plugin vulnerability allows unauthenticated attackers to upload potentially executable files, leading to possible remote code execution. WordPress site administrators and security teams should verify exposure and apply patches.

• Potential remote code execution
• Unauthenticated file uploads possible
• Exploitation requires leaked nonce
• Verification of patch application required

Technical summary

The 10Web Booster plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and a leaked nonce. This allows unauthenticated attackers to potentially execute remote code. The exploit chain involves obtaining a world-readable leaked nonce, which is automatically serialized to a file under wp-content/uploads/ during bulk optimization batches. The vulnerability exists in versions up to and including 2.34.10 of the 10Web Booster plugin. Defensive priority is high for WordPress site administrators and security teams to verify exposure and apply patches.

Defensive priority

High priority for WordPress site administrators and security teams to verify exposure and apply patches.

Recommended defensive actions

• Verify if the 10Web Booster plugin is installed and if the version is 2.34.10 or earlier.
• Check for the presence of the leaked nonce file under wp-content/uploads/
• Apply the patch or update the plugin to a version beyond 2.34.10.
• Monitor for suspicious file uploads and system changes.
• Review system logs for potential exploitation attempts.

Evidence notes

The vulnerability exists in versions up to and including 2.34.10 of the 10Web Booster plugin. The exploit chain involves obtaining a world-readable leaked nonce, which is automatically serialized to a file under wp-content/uploads/ during bulk optimization batches.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.