10Web Booster up to 2.34.10 - Unauthenticated Arbitrary File Upload (CVE-2026-108587)

10Web Booster versions through 2.34.10 contain a critical unauthenticated arbitrary file upload vulnerability that can lead to remote code execution. CVE-2026-108587 has a CVSS score of 9.8. The plugin has more than 60,000 active installations, and affected sites should update to 2.34.11 or later immediately.

Table of Contents

Vulnerability summary

Product: 10Web Booster – Website speed optimization, Cache & Page Speed optimizer
Plugin slug: tenweb-speed-optimizer
Affected versions: 2.34.10 and earlier
Fixed version: 2.34.11
CVE: CVE-2026-108587
Severity: Critical, CVSS 9.8
Authentication required: No
Impact: Arbitrary file upload with possible remote code execution

Exploit prerequisites

Wordfence reports that exploitation requires a valid tenwebio_rest REST nonce. During a paused bulk optimization batch, the vulnerable plugin can serialize that nonce into a world-readable file under wp-content/uploads/. Because the nonce is generated in a cron or loopback context with user ID 0, it can be valid for an unauthenticated visitor.

How the flaw works

The vulnerable compressCustom functionality does not adequately validate file types or filter the extension supplied through the page_id parameter. An attacker who obtains the exposed nonce can use the optimization route to write a file with a dangerous extension. If the server executes uploaded PHP files, this can become remote code execution and complete site compromise.

The vulnerability is not merely an upload of harmless media. The affected path can place executable content on the server. Patchstack classifies the issue as high priority and warns that arbitrary-upload flaws of this kind are commonly targeted in mass-exploitation campaigns. At publication time, WPDeeply found no authoritative confirmation that this CVE is listed in CISA’s Known Exploited Vulnerabilities catalog.

Immediate remediation

Update 10Web Booster to version 2.34.11 or later.
If an immediate update is impossible, deactivate the plugin and block public access to unexpected files created by the plugin under wp-content/uploads/.
Search the uploads directory for executable files and recently created files that do not match your normal media workflow.
Review access logs for unusual requests to 10Web Booster REST routes and requests referencing the page_id parameter.
If a suspicious executable file is found, preserve evidence, take the site out of service, rotate WordPress and hosting credentials, invalidate sessions, and investigate persistence before restoring traffic.

The vendor changelog describes version 2.34.11 as security hardening for the image optimization queue and REST API.

Verification and compromise checks

wp plugin get tenweb-speed-optimizer --fields=name,status,version,update,update_version
wp core verify-checksums
wp plugin verify-checksums tenweb-speed-optimizer
find wp-content/uploads -type f -name '*.php' -print
find wp-content/uploads -type f -mtime -14 -print

Confirm that the installed version is at least 2.34.11. A PHP file in uploads is a strong warning sign on a standard WordPress installation, but investigate context before deleting anything. Compare timestamps with access logs, WordPress users, plugin installations, scheduled tasks, and file modifications.

Indicators to review

Unexpected PHP, PHTML, PHAR, or similarly executable files under wp-content/uploads/.
World-readable optimization-state files containing tenwebio_rest or REST nonce data.
Requests to 10Web Booster REST endpoints followed by direct requests to a newly created upload.
New administrators, unfamiliar plugins, modified theme files, cron changes, or outbound connections after the suspicious upload.

10Web Booster up to 2.34.10 – Unauthenticated Arbitrary File Upload (CVE-2026-108587)