Disclosure: this page contains affiliate links. East Bay Cyber may earn a commission if you buy through them, at no extra cost to you. That never changes how we rank products. Editorial policy.

CVE-2026-108587: 10Web Booster Flaw

In CISA KEV

Published

Oct 15

CVE explainers 2026-10-15 9 min read

Security Research Desk Source-checked

Auto-checked against the official CVE record · Human-reviewed after publishing · Updated 2026-10-15

▲ Escalation ViewOne CVE, briefed at three altitudes — skim the Brief, weigh the Impact, or work the Runbook. The way a SOC actually reads it.

CISOBrief · 30-second brief

TL;DR - CVE-2026-108587 is a critical unauthenticated arbitrary file-upload flaw in 10Web Booster through version 2.34.10. - Attackers may abuse a leaked REST nonce to upload executable content and potentially achieve remote code execution. - No fixed version, public proof of concept, or confirmed in-the-wild exploitation was established. - Deactivate and remove the plugin if you cannot verify a vendor-approved remediation.

Vulnerability at a Glance

Field	Details
CVE	CVE-2026-108587
Product	10Web Booster – Website speed optimization, Cache & Page Speed optimizer
Platform	WordPress plugin
CVSS v3 base score	9.8 Critical
CVSS vector	Not included in the retrieved NVD record
Attack vector	Network, based on the unauthenticated web and REST request path described by NVD
Authentication or privileges required	None
Affected versions	All versions up to and including 2.34.10
Patch available	No confirmed fixed version established
CISA KEV status	Not listed as of the assessment date

CVE-2026-108587 is operationally serious because the attack does not require a WordPress account. A successful upload may place attacker-controlled content on the web server. If the server executes the uploaded file type, the impact can extend to remote code execution.

No confirmed patch is available, so administrators should not assume that installing a release newer than 2.34.10 resolves the issue. Verify a vendor release note or authoritative plugin advisory before treating an upgrade as remediation.

Analyst’s Take: The immediate priority is to identify active installations through version 2.34.10 and remove or deactivate the plugin where it is not required. The missing fixed version and unverified source references make vendor confirmation necessary before an upgrade can be treated as remediation.

What Is CVE-2026-108587?

CVE-2026-108587 is an arbitrary file-upload vulnerability in the plugin’s compressCustom function. The reported root cause is insufficient file-type validation and extension filtering, combined with unsafe handling of the page_id parameter. An attacker can use that combination to influence the upload operation with content that should have been rejected.

The exploit chain also involves the tenwebio_rest nonce. According to the NVD description, the nonce is automatically serialized into a world-readable file below wp-content/uploads/ when a bulk optimization batch pauses. The nonce is generated in a cron or loopback context with user ID 0, so it can remain valid for unauthenticated visitors instead of being limited to an authenticated administrator session.

The security failure is layered rather than limited to one missing check:

A REST nonce is exposed through a publicly readable file.
The nonce can satisfy an authentication check despite being generated in a user-zero context.
The compressCustom path does not adequately reject dangerous file types or extensions.
The page_id parameter can be abused as part of the upload request.
An executable upload may result in remote code execution, depending on web-server behavior and directory configuration.

The available research did not independently validate the referenced source files because the WordPress Trac requests returned HTTP 403. The technical description and version range are based on the retrieved NVD record.

AnalystImpact · assess the risk

Who Is Affected?

Affected installations are running the 10Web Booster WordPress plugin in all versions up to and including 2.34.10. The relevant component includes the plugin’s image-optimization and REST-related code, including the compressCustom function and associated queue, REST, and utility paths.

The NVD-linked source references identify tag 2.34.1, which falls inside the affected range. These references include QueueRestart.php, CompressService.php, Rest.php, and Utils.php. Their presence in the vulnerable range does not establish that every installation uses an identical deployment configuration. It does indicate that administrators should treat versions at or below 2.34.10 as exposed.

The issue is most concerning on WordPress sites where:

The plugin is active and can process optimization jobs.
wp-content/uploads/ is directly readable from the Internet.
The web server executes PHP or another uploaded server-side format.
Uploaded files are not isolated from the site’s document root.
Administrators cannot immediately confirm a vendor-fixed release.

A site may have additional compensating controls, such as a web application firewall or non-executable uploads directory. Those controls should not be treated as proof that the vulnerable code path is safe.

CVSS Score Breakdown

The reported CVSS v3 base score is 9.8 Critical. The retrieved NVD record supplied the score but did not include a CVSS vector. Consequently, the exact component values, such as the precise scope and user-interaction settings, cannot be independently reconstructed from the supplied record.

The practical interpretation is clear. The described attack is remotely reachable, requires no authenticated account, and does not depend on a legitimate user approving an action. The potential impact includes unauthorized file placement and, where uploaded content is executed, compromise of confidentiality, integrity, and availability.

Administrators should avoid publishing an invented vector or assuming that a missing vector changes the severity. Use 9.8 as the authoritative reported base score for triage, while recognizing that environmental controls can alter the effective risk for an individual site. For example, a correctly configured non-executable uploads directory can reduce the likelihood of direct code execution, but it does not remove the underlying unauthorized-upload condition.

Exploitation Status

CVE-2026-108587 was not present in the CISA Known Exploited Vulnerabilities catalog at the assessment date of 2026-10-15. There is therefore no CISA date-added date, remediation deadline, required action, or ransomware-campaign designation for this CVE.

No confirmed active exploitation in the wild was identified in the available NVD or KEV information. No verified public proof-of-concept repository or exploit publication was identified in the research performed for this assessment. The social and GitHub mention counts in the page metadata reflect that no verified mentions or repositories were established by the supplied research, not proof that no discussion exists anywhere.

The lack of confirmed exploitation should not lower the remediation priority. A critical, unauthenticated upload flaw with a plausible route to remote code execution can be exploited before public reporting catches up. Treat Internet-facing affected sites as high priority, especially where the plugin is not required for current business operations.

ResponderRunbook · act now

How to Detect CVE-2026-108587

Detection should focus on three areas: requests to the plugin’s REST functionality, unexpected files under wp-content/uploads/, and web-server execution of files that were recently created in upload directories. Review historical data as well as live traffic because an attacker may upload a file and remove the original request evidence later.

Technical Detection Notes

Search web and application logs for the plugin name, the affected function, and suspicious parameter values. The exact REST route is not established in the available material, so defenders should search broadly rather than rely on one unverified endpoint:

grep -R -Ei \\
  'tenwebio_rest|compressCustom|page_id=|tenweb|wp-json' \\
  /var/log/nginx /var/log/apache2 2>/dev/null

On the WordPress host, identify recently modified files below the uploads directory and flag server-side extensions. Adapt the time window and extension list to the site’s technology:

find /var/www/html/wp-content/uploads \\
  -type f -mtime -30 \\
  \( -iname '*.php' -o -iname '*.phtml' -o -iname '*.php[0-9]' \\
     -o -iname '*.phar' -o -iname '*.cgi' \) \\
  -printf '%TY-%Tm-%Td %TH:%TM:%TS %u %m %p\\n'

A useful SIEM analytic is to alert when an unauthenticated request is followed within a short interval by creation of a PHP or other executable file under wp-content/uploads/. Also alert on requests containing compressCustom or unusual page_id values, particularly when the source address has no prior authenticated WordPress activity.

Check whether publicly readable files contain serialized plugin state or nonce material. Do not disclose discovered nonce values in tickets or shared logs; treat them as credentials and preserve them only under the organization’s incident-response handling procedures.

Mitigation and Patching

The affected range is all versions through and including 2.34.10. A specific fixed version was not established from the retrieved NVD record or the available reference material. The correct remediation is to upgrade to a vendor-confirmed fixed release when one is documented, then verify the installed version and review the site for signs of exploitation.

Until a confirmed fix is available, the safest operational workaround is to deactivate and remove the plugin if the site can function without it. A WP-CLI example is:

wp plugin deactivate tenweb-speed-optimizer
wp plugin delete tenweb-speed-optimizer

Use the plugin’s actual installed directory if it differs, and take a backup before removal where appropriate. For recovery planning, review these backup solutions for ransomware recovery before making changes to a production site.

If removal is not immediately possible, restrict access to the plugin’s REST functionality with the site’s reverse proxy or WAF, deny direct access to exposed nonce or serialized files under wp-content/uploads/, and ensure uploads are not executable.

Technical Workarounds

A temporary Apache rule can prevent PHP execution in the uploads tree, subject to the site’s existing configuration and web-server architecture:

# Place in the uploads directory configuration where permitted
<FilesMatch "\.(php|phtml|phar|php[0-9])$">
    Require all denied
</FilesMatch>

For Nginx, ensure the PHP location does not process files beneath uploads. A common defensive pattern is to deny requests for server-side extensions in that path:

location ~* ^/wp-content/uploads/.*\.(php|phtml|phar|php[0-9])$ {
    deny all;
    return 403;
}

These controls are workarounds, not a substitute for fixing the plugin’s authorization and validation flaws. After containment, rotate WordPress administrator credentials, hosting credentials, database credentials, and relevant API keys if unauthorized uploads or command execution are found. A password manager such as 1Password can help teams generate and rotate unique administrative credentials.

Preserve suspicious files and logs for forensic analysis before deleting them. If you identify signs of malware, isolate the affected site and scan it with a trusted security tool such as Malwarebytes before restoring normal service.

Organizations should also require phishing-resistant or otherwise strong multi-factor authentication for WordPress administrators. See this multi-factor authentication guide for background on MFA terminology and implementation.

References

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.