Path Traversal Vulnerability in 10Web Booster for WordPress
CVE-2026-103896

7.5HIGH

Key Information:

Vendor

WordPress
Status
10web Booster – Website Speed Optimization, Cache & Page Speed Optimizer
Vendor
CVE Published:
16 October 2026

What is CVE-2026-103896?

The 10Web Booster plugin for WordPress is vulnerable to a limited file write due to improper handling of unsanitized input in cache path generation. This vulnerability allows unauthorized attackers to create directories outside the designated cache root and to write cached pages into them with a fixed filename, 'source.html'. While this does not enable code execution or the writing of PHP files, it results in potential cache poisoning and directory creation, compromising the integrity of the caching mechanism.

Affected Version(s)

10Web Booster – Website speed optimization, Cache & Page Speed optimizer 0 <= 2.34.5

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/tenweb-speed-o...
https://plugins.trac.wordpress.org/browser/tenweb-speed-o...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Swayam Bhageria
.