A critical (CVSS 9.8) flaw in the 10Web Booster WordPress plugin lets unauthenticated attackers upload files that may be executable, which makes remote code execution possible, in all versions up to and including 2.34.10.
What Is It
CVE-2026-108587 is an arbitrary file upload vulnerability (CWE-434) in the plugin's compressCustom function. The plugin's full name is "10Web Booster – Website speed optimization, Cache & Page Speed optimizer". Two problems combine to cause it:
- Missing validation: the plugin does not check file types or filter extensions on the
page_idparameter. - Leaked nonce: the plugin's REST nonce (
tenwebio_rest) gets around its authentication checks. Whenever a bulk optimisation batch pauses, the plugin automatically writes this nonce to a world-readable file underwp-content/uploads/. The nonce is generated in a cron/loopback context with a user ID of 0, so it is valid for unauthenticated visitors.
An attacker who reads the leaked nonce can use it to reach the vulnerable upload path without logging in.
Why It Matters
Wordfence scored the flaw CVSS 3.1 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That means:
- it can be exploited over the network,
- attack complexity is low,
- no privileges or user interaction are needed,
- impact on confidentiality, integrity and availability is high.
Uploading executable files can lead to remote code execution on the WordPress host.
The supplied CISA KEV entry is empty. KEV does not currently confirm active exploitation of this CVE. NVD lists the record as "Received", published 2026-10-15, so it has not been fully analyzed yet.
What's Vulnerable
- Vendor: 10web
- Product: 10Web Booster – Website speed optimization, Cache & Page Speed optimizer (WordPress plugin, slug
tenweb-speed-optimizer) - Affected versions: all versions up to and including 2.34.10
The NVD record does not list any CPEs.
Patch Status
The supplied data does not name a fixed version. NVD references a WordPress plugin repository changeset (3743299) for tenweb-speed-optimizer. Only versions through 2.34.10 are listed as affected.
There is no CISA KEV required action or due date, because the CVE is not in KEV.
Administrators should:
- check the Wordfence advisory and the plugin changeset to confirm a release later than 2.34.10 that contains the fix, then update;
- if no fixed release is available, consider deactivating the plugin;
- check
wp-content/uploads/for exposed queue or nonce files.