Key points
- CVE-2026-108587 is rated CVSS 9.8 Critical by the National Vulnerability Database.
- The vulnerability affects all versions of the 10Web Booster plugin up to and including 2.34.10.
- Attackers exploit a world-readable nonce leak to bypass authentication and upload arbitrary files.
The 10Web Booster plugin for WordPress contains a critical security flaw that allows unauthenticated attackers to execute remote code on affected websites. According to the National Vulnerability Database, this vulnerability, tracked as CVE-2026-108587, stems from missing file type validation and extension filtering. The issue exists in the compressCustom function and affects all plugin versions up to and including 2.34.10.
By the numbers
- CVSS 9.8: The severity score assigned by the National Vulnerability Database for CVE-2026-108587.
- 2.34.10: The highest version of the 10Web Booster plugin currently affected by this arbitrary file upload flaw.
- CWE-434: The Common Weakness Enumeration identifier for the unrestricted upload of executable file type.
What the figures mean
The high severity score reflects the ease with which an attacker can compromise a site. The NVD record explains that the exploit chain requires obtaining the plugin's REST nonce, specifically tenwebio_rest. This nonce is automatically serialized to a world-readable file within the wp-content/uploads directory whenever a bulk optimization batch pauses. Because the nonce is generated in a cron or loopback context with a user ID of zero, it remains valid for unauthenticated visitors. This mechanism effectively bypasses standard authentication checks.
An attacker can use this leaked nonce to interact with the compressCustom function. Since the function lacks proper file type validation and extension filtering on the page_id parameter, the attacker can upload files that may be executable. This capability enables remote code execution on the server hosting the WordPress installation. The NVD classifies this weakness under CWE-434, highlighting the risk of uploading executable files without restriction.
What to watch
Security teams should monitor for unauthorized file uploads in the wp-content/uploads directory, particularly those occurring during or after bulk optimization tasks. The presence of a tenwebio_rest nonce file that is world-readable indicates a potential exposure. Analysts should also look for unusual cron job behaviors or loopback requests that generate nonces with a user ID of zero. Any executable files appearing in directories where only images or cache data should reside warrant immediate investigation.
Infection and persistence in general
Teams usually encounter this category of threat when attackers exploit configuration errors or logic flaws in popular plugins. Persistence is often achieved by uploading web shells or backdoors that survive standard cleanup efforts. Analysts examine file creation timestamps, user agent strings, and server logs to trace the initial access vector. They also check for modifications to core files or the presence of unknown scripts in upload directories. Monitoring for unusual outbound connections helps identify command-and-control communications once the attacker has established a foothold.
What to do and how to stay safe: 10Web
- Review the wp-content/uploads directory for any world-readable files containing nonces or unexpected executable scripts.
- Verify that the 10Web Booster plugin is updated to a version newer than 2.34.10 if a patch has been released.
- Monitor server logs for unauthenticated requests targeting the compressCustom function or the tenwebio_rest endpoint.
- Implement strict file type validation and extension filtering at the web server level to block executable uploads.
Step-by-step guide: Patch Management Implementation: A Step-by-Step Rollout Plan
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of 10Web Booster are affected by CVE-2026-108587?
All versions of the 10Web Booster plugin up to and including 2.34.10 are vulnerable to this arbitrary file upload flaw.
How does the attacker bypass authentication in this exploit?
The attacker uses a world-readable leaked nonce, tenwebio_rest, which is valid for unauthenticated visitors because it is generated with a user ID of zero.
What is the CVSS score for this vulnerability?
The National Vulnerability Database rates CVE-2026-108587 as CVSS 9.8 Critical.
