Arbitrary File Upload Vulnerability in 10Web Booster Plugin for WordPress

CVE-2026-108587

What is CVE-2026-108587?

The 10Web Booster plugin for WordPress has a significant security vulnerability that allows unauthenticated attackers to upload arbitrary files to the server. This flaw arises from insufficient file type validation and improper extension filtering on the 'page_id' parameter, coupled with a publicly accessible nonce. This nonce, intended for authentication, becomes reachable by attackers due to its world-readable serialization under the wp-content/uploads directory during optimization processes. By exploiting these weaknesses, attackers can execute remote code on the server, posing substantial risks to affected websites.

References