Arbitrary File Upload in 10Web Booster WordPress Plugin (CVE-2026-108587)

The 10Web Booster plugin for WordPress (versions 2.34.10 and earlier) contains a critical arbitrary file upload vulnerability (CVE-2026-108587) within its compressCustom function. This flaw arises from insufficient file type validation and extension filtering on the page_id parameter. The vulnerability is chained with an authentication bypass facilitated by a publicly accessible, world-readable nonce (tenwebio_rest). This nonce is generated during bulk optimization batches in a cron/loopback context with a user ID of 0, resulting in it being exposed within files in the wp-content/uploads/ directory. By obtaining this nonce, unauthenticated attackers can interact with the vulnerable REST endpoint to upload malicious, potentially executable files to the web server, leading to full remote code execution. This poses a severe risk to any WordPress environment running the affected plugin versions.

Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary code on the underlying web server. Given the nature of WordPress plugins, this could lead to full site compromise, unauthorized data exfiltration, and the establishment of persistent backdoors. The ubiquity of WordPress plugins makes this a significant risk for the large volume of websites utilizing the 10Web Booster for performance optimization.

Recommendation

Prioritized actions for security teams:

• Update the 10Web Booster plugin to the latest available version (beyond 2.34.10) where the fix is implemented.
• Audit the wp-content/uploads/ directory for any world-readable files containing the tenwebio_rest nonce or other sensitive configuration parameters.
• Monitor web server access logs for anomalous POST requests to REST API endpoints associated with the 10Web Booster, specifically targeting the compressCustom function or suspicious file uploads.
• Review file system permissions in wp-content/uploads/ to ensure files are not inadvertently set to world-readable if they contain application secrets.