External risk intelligence

10Web Booster WordPress Plugin Arbitrary File Upload Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-108587

The vulnerability affects a WordPress plugin, which is a component of a web application designed to be public-facing by default. Because WordPress sites are internet-accessible web services, the plugin's functionality is exposed to the public internet, and the flaw allows unauthenticated remote interaction with the application's file upload capabilities.

Unrestricted File Upload

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a WordPress optimization plugin that allows unauthenticated attackers to upload executable files, potentially leading to remote code execution. This issue stems from insufficient validation of file uploads and a leaked authentication token accessible to anyone. The primary concern is confirming if this plugin is in use and if it is exposed to the internet.

Attackers can upload harmful files without logging in.
Affects WordPress sites using a popular optimization plugin.
Confirm usage and exposure for potential risk.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by first obtaining a leaked authentication nonce. This nonce, when combined with a request to the plugin's compressCustom function, allows an unauthenticated attacker to upload arbitrary files, potentially leading to remote code execution on the affected WordPress site.

No authentication required.
Upload arbitrary files via compressCustom function.
Remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to upload and execute arbitrary files on a WordPress website. This is possible when a bulk optimization process pauses, leaking a nonce that bypasses authentication. The consequence is remote code execution on the affected server.

Website files and server access.
Upload executable files via leaked nonce.
Remote code execution on server.

Operational Fix

Recommended remediation, mitigation, and detection steps

WordPress site owners and their associated infrastructure or platform teams are most likely responsible for addressing this vulnerability. The initial practical step is to identify all instances of the affected WordPress plugin, determine their internet accessibility and business criticality, and then assign ownership for remediation planning.

Identify and assign ownership of affected systems.
Verify plugin reachability and business impact.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the 10Web Booster plugin?

10Web Booster is a WordPress plugin designed to improve website performance. It includes tools for caching and optimizing page load speeds. This specific vulnerability exists within its file compression and optimization features, which are installed on WordPress environments to help handle image and content processing.

How does CVE-2026-108587 enable file uploads?

This vulnerability is classified as Unrestricted Upload of File with Dangerous Type (CWE-434). It occurs because the software fails to properly check file types or extensions when processing requests. An attacker can use a leaked security token, or nonce, to bypass login requirements, allowing them to upload and potentially execute malicious files on the server hosting the WordPress site.

Do I need to be logged in for this to trigger?

No. The vulnerability is exploitable by unauthenticated attackers. The trigger relies on obtaining a security token that is unintentionally saved to a publicly accessible file whenever the plugin's bulk optimization process pauses. If the plugin has not recently performed a bulk optimization that paused, the specific leaked token required for this exploit chain may not be present.

Why is this a risk for my WordPress site?

Halo Surface Signal notes that since 10Web Booster is a WordPress plugin, it is naturally part of a web-accessible application. This means the affected functionality is reachable from the public internet. Because the flaw allows remote, unauthenticated file uploads, any site using an affected version of the plugin is considered exposed to potential remote code execution by external actors.

When should I take action for this plugin?

You should act immediately by auditing your WordPress installations to see if the 10Web Booster plugin is active. Once identified, evaluate the accessibility of those sites and prioritize them for updates. The primary goal is to remove the vulnerable code from your environment to prevent unauthorized file execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.