CVE-2026-108587

Name of the Vulnerable Software and Affected Versions 10Web Booster versions prior to 2.34.11

Description An arbitrary file upload issue exists in the compressCustom() function. The flaw stems from missing file type validation and extension filtering on the page id parameter. This is combined with a leaked REST nonce (tenwebio rest) that is automatically serialized to a world-readable file in the wp-content/uploads/ directory whenever a bulk optimization batch pauses. Since this nonce is generated with a user ID of 0, it allows unauthenticated attackers to bypass authentication checks and upload executable files, leading to remote code execution.

Recommendations Update the plugin to a version newer than 2.34.10.