{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-108587/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:10web:booster:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-108587"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["10Web Booster (\u003c= 2.34.10)"],"_cs_severities":["critical"],"_cs_tags":["web-application","wordpress","remote-code-execution","cve-2026-108587"],"_cs_type":"advisory","_cs_vendors":["10Web"],"content_html":"\u003cp\u003eThe 10Web Booster plugin for WordPress (versions 2.34.10 and earlier) contains a critical arbitrary file upload vulnerability (CVE-2026-108587) within its \u003ccode\u003ecompressCustom\u003c/code\u003e function. This flaw arises from insufficient file type validation and extension filtering on the \u003ccode\u003epage_id\u003c/code\u003e parameter. The vulnerability is chained with an authentication bypass facilitated by a publicly accessible, world-readable nonce (\u003ccode\u003etenwebio_rest\u003c/code\u003e). This nonce is generated during bulk optimization batches in a cron/loopback context with a user ID of 0, resulting in it being exposed within files in the \u003ccode\u003ewp-content/uploads/\u003c/code\u003e directory. By obtaining this nonce, unauthenticated attackers can interact with the vulnerable REST endpoint to upload malicious, potentially executable files to the web server, leading to full remote code execution. This poses a severe risk to any WordPress environment running the affected plugin versions.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to execute arbitrary code on the underlying web server. Given the nature of WordPress plugins, this could lead to full site compromise, unauthorized data exfiltration, and the establishment of persistent backdoors. The ubiquity of WordPress plugins makes this a significant risk for the large volume of websites utilizing the 10Web Booster for performance optimization.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the 10Web Booster plugin to the latest available version (beyond 2.34.10) where the fix is implemented.\u003c/li\u003e\n\u003cli\u003eAudit the \u003ccode\u003ewp-content/uploads/\u003c/code\u003e directory for any world-readable files containing the \u003ccode\u003etenwebio_rest\u003c/code\u003e nonce or other sensitive configuration parameters.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for anomalous \u003ccode\u003ePOST\u003c/code\u003e requests to REST API endpoints associated with the 10Web Booster, specifically targeting the \u003ccode\u003ecompressCustom\u003c/code\u003e function or suspicious file uploads.\u003c/li\u003e\n\u003cli\u003eReview file system permissions in \u003ccode\u003ewp-content/uploads/\u003c/code\u003e to ensure files are not inadvertently set to world-readable if they contain application secrets.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T06:35:20Z","date_published":"2026-10-15T06:35:20Z","id":"https://feed.craftedsignal.io/briefs/2026-10-15-10web-booster-rce/","summary":"An unauthenticated remote code execution vulnerability exists in 10Web Booster versions 2.34.10 and earlier due to insecure file handling and nonce leakage.","title":"Arbitrary File Upload in 10Web Booster WordPress Plugin (CVE-2026-108587)","url":"https://feed.craftedsignal.io/briefs/2026-10-15-10web-booster-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-108587","version":"https://jsonfeed.org/version/1.1"}