Description

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the page_id parameter, combined with a world-readable leaked nonce that bypasses authentication checks. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. This exploit chain requires obtaining the plugin's REST nonce (tenwebio_rest), which is automatically serialized to a world-readable file under wp-content/uploads/ whenever a bulk optimisation batch pauses; because the nonce is generated in a cron/loopback context with a user ID of 0, it is valid for unauthenticated visitors.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-15T05:17:02.637Z",
  "pubdate": "2026-10-15T05:17:02.637Z",
  "executiveSummary": "The 10Web Booster plugin for WordPress, in versions up to and including 2.34.10, contains a critical vulnerability allowing unauthenticated remote code execution via arbitrary file upload.\nThe flaw stems from insufficient input validation in the compressCustom function and a security breakdown involving the disclosure of a valid, world-readable REST API nonce.\nAn unauthenticated attacker can exploit this by obtaining the leaked tenwebio_rest nonce from a publicly accessible file generated during background optimization tasks. Once the nonce is acquired, the attacker can bypass authentication checks and leverage the unprotected file upload mechanism to execute malicious code on the server.\nThis vulnerability presents a high risk to the confidentiality, integrity, and availability of the affected WordPress environment, as it grants attackers the ability to compromise the host server directly through the execution of arbitrary scripts.\nSuccessful exploitation requires minimal effort once the nonce is discovered, as the attack does not necessitate pre-existing administrative credentials, effectively widening the potential threat actor profile to include any remote unauthenticated user capable of accessing the public uploads directory.",
  "technicalDetails": "The vulnerability resides within the 10Web Booster plugin's compressCustom function, which lacks adequate server-side validation for file types and extensions. This function, intended for processing custom image optimization, fails to sanitize the page_id parameter, allowing an attacker to submit malicious files. Because there are no restrictions on the file format, an attacker can upload executable scripts, such as PHP backdoors, directly to the web server's file system.\nThe primary security failure facilitating this exploit is the improper handling of the tenwebio_rest nonce. The plugin generates this nonce within a cron or loopback process with a user ID of 0. When a bulk optimization batch pauses, the plugin serializes the state to a file located within wp-content/uploads/. Because this directory is often publicly indexable and the resulting file is world-readable, the nonce is exposed to unauthorized external observers. Under standard WordPress REST API configuration, this leaked nonce is accepted as valid by the server, allowing the unauthenticated request to bypass the authorization layer that would otherwise protect the compressCustom function.\nThe attack flow proceeds in two distinct stages. First, the attacker monitors or probes the wp-content/uploads/ directory for serialized files generated by the 10Web Booster's background processes. Upon identifying and retrieving the leaked tenwebio_rest nonce, the attacker crafts a multipart/form-data request targeting the vulnerable endpoint associated with the compressCustom function. By injecting the obtained nonce into the request headers and providing a malicious payload via the insecure parameter, the attacker forces the plugin to write the file to a location where it can be executed by the web server process.\nPost-exploitation, the attacker gains the ability to execute arbitrary PHP code with the permissions of the web server user (e.g., www-data). This enables a full spectrum of malicious activities, including data exfiltration, modification of database contents, unauthorized creation of administrative users, and the potential lateral movement within the hosting infrastructure. The lack of validation on the file content and the bypass of the nonce-based authentication mechanism make this a trivial yet highly impactful remote code execution vector for any exposed WordPress installation utilizing the affected versions of 10Web Booster."
}