CVE-2026-103896

7.5High

Published 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on integrity
Weakness: CWE-22

Impact

Unauthenticated remote attackers can create arbitrary directories and poison page caches on exposed WordPress sites. Attackers do not need credentials, but write access is limited to rendered page HTML files named source.html, preventing direct PHP execution.

Root cause

The OptimizerWebPageCache::get_cache_file_dir() function concatenates unsanitized $_GET parameters directly into cache directory paths without realpath containment checks before creating directories and writing files.

Affected systems

10Web Booster WordPress plugin versions up to and including 2.34.5

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Fix & remediation

Upgrade the 10Web Booster plugin to version 2.34.8 or later. If patching immediately is not possible, disable the page caching feature inside the plugin settings.

shell

$ wp plugin update tenweb-speed-optimizer

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::get_cache_file_dir() function concatenating raw, unsanitized $_GET parameter names and values into the on-disk cache path, and the cache_content() sink calling mkdir() and file_put_contents() on the result with no realpath containment check — unlike the sibling delete_page_cache(), which does perform one. This makes it possible for unauthenticated attackers to create arbitrary directories (mode 0777, recursively) outside the cache root and write a cached page into them. The write is LIMITED: the filename is always 'source.html', so the extension is fixed, and the content is the rendered page buffer rather than attacker-supplied data. PHP files cannot be written and code execution is not possible; the demonstrated impact is cache poisoning and arbitrary directory creation.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-103896