CVE-2026-103896
HighCVSS 7.5Summary
The 10Web Booster plugin for WordPress (versions up to and including 2.34.5) is vulnerable to limited file write via path traversal. An unauthenticated attacker can create arbitrary directories outside the cache root and write cached pages into them, leading to cache poisoning and arbitrary directory creation.
Risk Assessment
Cache poisoning and arbitrary directory creation are possible, but PHP files cannot be written and code execution is not possible, limiting the impact to these two effects.
Recommendation
Update the 10Web Booster plugin to a version later than 2.34.5 or disable it; consider restricting access to the page caching functionality.
Other vulnerabilities in 10Web Booster
See all- CVE-2026-94121High
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin in versions <= 2.33.6 is vulnerable to PHP Object Injection. The vulnerability can be exploited by a user with Contributor privileges.
- CVE-2026-108587Critical
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. Missing file type validation and extension filtering on the page_id parameter, combined with a world-readable leaked nonce that bypasses authentication checks, makes it possible for unauthenticated attackers to upload files that may be executable, leading to remote code execution.
- CVE-2025-13377Critical
The 10Web Booster plugin for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the get_cache_dir_for_page_from_url() function in all versions up to and including 2.32.7. This allows authenticated attackers with Subscriber-level access and above to delete arbitrary folders on the server, potentially leading to data loss or denial of service.
- CVE-2026-107742High
The 10Web Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in versions up to and including 2.34.8. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses the page.
Original NVD description (English source)
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::get_cache_file_dir() function concatenating raw, unsanitized $_GET parameter names and values into the on-disk cache path, and the cache_content() sink calling mkdir() and file_put_contents() on the result with no realpath containment check — unlike the sibling delete_page_cache(), which does perform one. This makes it possible for unauthenticated attackers to create arbitrary directories (mode 0777, recursively) outside the cache root and write a cached page into them. The write is LIMITED: the filename is always 'source.html', so the extension is fixed, and the content is the rendered page buffer rather than attacker-supplied data. PHP files cannot be written and code execution is not possible; the demonstrated impact is cache poisoning and arbitrary directory creation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS