CVE-2026-108587: Unauthenticated Arbitrary File Upload in 10Web Booster Leads to RCE

Overview

A critical vulnerability has been disclosed in 10Web Booster (also distributed as "10Web Booster – Website speed optimization, Cache & Page Speed optimizer"), a WordPress performance plugin. Tracked as CVE-2026-108587 with a maximum-severity CVSS score of 9.8, the flaw lets an unauthenticated attacker upload arbitrary files, including executable code, through the plugin's compressCustom function — resulting in full remote code execution on the underlying WordPress site.

The vulnerability was identified and assigned by Wordfence and affects all versions up to and including 2.34.10.

Technical Details

How It Works

The flaw is a chain of two compounding issues rather than a single missing check:

1. Missing file-type validation. The plugin's compressCustom function processes a caller-supplied page_id parameter without validating file type or filtering extensions, so an attacker can submit a file that WordPress will treat as executable.
2. Nonce leakage that defeats the auth check. The upload endpoint is gated behind a REST nonce (tenwebio_rest). Under normal conditions that nonce requires an authenticated session — but the plugin generates it inside a cron/loopback context where the associated user ID is set to 0, producing a nonce that is valid for unauthenticated visitors. Worse, whenever a bulk optimization batch pauses, that nonce is serialized and written to a world-readable file under wp-content/uploads/, where any remote visitor can retrieve it.

Combined, these two bugs mean an attacker only needs to fetch the leaked nonce from a predictable, publicly accessible path and then call compressCustom with a malicious file — no credentials, no session, and no user interaction required.

Impact Assessment

Mitigation

Immediate Actions

• Update 10Web Booster to the patched version referenced in the WordPress plugin repository changeset as soon as it is available in your site's plugin updates.
• Audit wp-content/uploads/ for unexpected files, particularly PHP or other executable files that should never appear in a media uploads directory.
• Restrict direct execution of uploaded files in the uploads directory via server configuration (e.g., disabling PHP execution in wp-content/uploads/ through .htaccess or equivalent web-server rules) as a defense-in-depth measure regardless of patch status.

Detection Opportunities

• Review web server access logs for requests to compressCustom-related REST endpoints from IPs with no prior authenticated session.
• Search for world-readable files under wp-content/uploads/ containing serialized nonce data, and treat their presence as a leading indicator of exposure even absent confirmed exploitation.
• Monitor for newly created executable files (.php, .phtml, etc.) appearing in uploads directories outside of expected media management workflows.

Defence-in-Depth

• Apply the principle of least privilege to the web server process account so that even successful code execution has limited reach into the host system.
• Keep a web application firewall (WAF) rule set current for WordPress plugin upload vulnerabilities, which this plugin class is frequently targeted by once a CVE is public.
• Regularly audit installed plugins for unmaintained or infrequently updated code, especially those handling file uploads or REST API endpoints.

Discovery & Disclosure

The vulnerability was reserved on October 10, 2026 and published on October 15, 2026, with Wordfence serving as the CVE assigner. As of publication, CVE-2026-108587 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and no public proof-of-concept exploit has been confirmed — but the unauthenticated, zero-interaction attack path combined with the maximum CVSS score makes this a priority patch for any site running the plugin.

References

• NVD — CVE-2026-108587
• Wordfence Threat Intelligence — CVE-2026-108587
• WordPress Plugin Repository — tenweb-speed-optimizer changeset