CVE-2026-82195

MediumCVSS 6.5

Published: 24/09/2026(UTC)Updated: 24/09/2026(UTC)Translated: 24/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

3th percentile - higher than 3% of all known CVEs

Summary

The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud connection, disclosing that secret to unauthenticated visitors and letting them delete it repeatedly, preventing an administrator from completing a legitimate connection.

Risk Assessment

Disclosure of the secret may allow attackers to impersonate the cloud connection, and its deletion can disrupt the plugin's operation and prevent administrator configuration.

Recommendation

Update the 10Web Booster plugin to version 2.34.0 or later.

Other vulnerabilities in 10Web Booster WordPress Plugin

CVE-2026-14287Medium
The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing an unauthenticated attacker to store markup that executes as JavaScript in the browser of anonymous visitors.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS