CVE-2026-94121
HighCVSS 8.8Summary
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin in versions <= 2.33.6 is vulnerable to PHP Object Injection. The vulnerability can be exploited by a user with Contributor privileges.
Risk Assessment
A low-privileged user (Contributor) can exploit the vulnerability to inject a malicious PHP object, potentially leading to remote code execution or full site compromise.
Recommendation
Update the 10Web Booster plugin to a version higher than 2.33.6. If update is not possible, consider temporarily disabling the plugin.
Other vulnerabilities in 10Web Booster
See all- CVE-2026-107742High
The 10Web Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in versions up to and including 2.34.8. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses the page.
- CVE-2025-13377Critical
The 10Web Booster plugin for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the get_cache_dir_for_page_from_url() function in all versions up to and including 2.32.7. This allows authenticated attackers with Subscriber-level access and above to delete arbitrary folders on the server, potentially leading to data loss or denial of service.
Original NVD description (English source)
Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS