Key points
- The flaw affects 10Web Booster versions up to and including 2.34.10.
- A world-readable nonce leak allows unauthenticated file uploads.
- The vulnerability carries a CVSS score of 9.8, rated Critical.
Attackers gain the ability to execute arbitrary code on affected WordPress installations without needing valid user credentials. This access is achieved by exploiting a specific flaw in the 10Web Booster plugin, which permits the upload of executable files. The vulnerability exists in all plugin versions released up to and including 2.34.10, leaving a large number of sites potentially exposed to remote exploitation.
According to the National Vulnerability Database, the issue is classified as an Arbitrary File Upload weakness (CWE-434). The exploit chain relies on the plugin generating a REST API nonce that becomes accessible to anyone. This happens when a bulk optimisation task pauses, causing the nonce to be written to a world-readable file within the wp-content/uploads directory.
Authentication Bypass Mechanism
The core security failure involves the mishandling of authentication tokens. The plugin generates the tenwebio_rest nonce in a cron or loopback context with a user ID of zero. Consequently, this token remains valid for unauthenticated visitors. An attacker only needs to locate this leaked file to obtain the necessary credentials to bypass standard authentication checks for the plugin’s functions.
Affected Systems
The vulnerability impacts WordPress sites using the 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin. Any installation running version 2.34.10 or any earlier version is vulnerable. The flaw specifically targets the compressCustom function, which fails to validate file types or filter extensions when processing the page_id parameter.
What happens next
Site administrators should verify the version of the 10Web Booster plugin currently installed on their WordPress installations. If the version is 2.34.10 or older, the site is at risk. Administrators must monitor web server logs for unusual upload activity or access to files within the uploads directory that may indicate an attempt to retrieve the leaked nonce.
Why this attack works
Teams usually investigate cases where authentication tokens are stored insecurely. This incident highlights the risk of writing sensitive credentials to publicly accessible locations. Attackers exploit the gap between token generation and secure storage. Check whether your systems write API keys or nonces to directories that allow public reading. Ensure that authentication tokens generated in automated contexts are not accessible to unauthenticated users. Verify that file upload functions strictly enforce type and extension validation.
Background: Authentication bypass vulnerabilities
Authentication bypass flaws rarely stem from weak passwords. They typically arise from logic errors in how applications process identity tokens, session states or internal trust boundaries. Misconceptions about where these vulnerabilities hide lead teams to overlook critical server-side validation gaps and trust assumptions that attackers exploit to gain unauthorised access.
Read the full guide: Authentication Bypass Myths: What Security Teams Get Wrong
What to do and how to stay safe: 10Web Booster
- Audit WordPress installations to confirm the 10Web Booster plugin version.
- Monitor server logs for suspicious file upload attempts or unauthorized access to upload directories.
- Restrict public read access to the wp-content/uploads directory to prevent nonce discovery.
- Review plugin configurations to ensure automatic updates are enabled once a patch is available.
Step-by-step guide: Patch Management Policy: How to Automate Fixes Without Breaking Systems
General security guidance from the Payload Report newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which plugin versions are vulnerable to CVE-2026-108587?
All versions of 10Web Booster up to and including 2.34.10 are vulnerable.
What is the severity rating of this vulnerability?
The National Vulnerability Database rates the vulnerability as Critical with a CVSS score of 9.8.
How do attackers bypass authentication in this exploit?
Attackers retrieve a leaked REST nonce from a world-readable file created during paused optimisation tasks.
