10Web Booster CVE-2026-108587

Exploitation requires that the plugin have run a bulk optimisation batch that paused at least once, causing the tenwebio_rest REST nonce to be serialized to a world-readable file under wp-content/uploads/; because that nonce is generated in a cron/loopback context with user ID 0, it is valid for unauthenticated visitors and bypasses the authentication check on the compressCustom function. Given that leaked nonce, no authentication or user interaction is needed (PR:N/UI:N) and the missing file-type/extension validation on the page_id parameter permits upload of executable files. The principal limiting factor is the dependency on the nonce-leak state existing on the target; sites that have never paused a bulk optimisation batch would not expose the nonce file, and the uploaded file must land in a web-accessible, PHP-executing path for RCE.

Signals mostly align toward genuine high priority, with one important nuance. The input CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a remote, unauthenticated, full-impact RCE via arbitrary file upload (CWE-434), which on its face is critical. However, the description reveals a real exploitation precondition that the AC:L rating understates: the attacker must first obtain the tenwebio_rest nonce, which only becomes world-readable after a bulk optimisation batch pauses and serializes it to wp-content/uploads/. This is a condition outside the attacker's direct control, which in my independent assessment lowers attack complexity realism (I assess AC:H / CVSS 4.0 AT:P) even though the end impact remains full RCE. No EPSS score, KEV listing, POC, or SSVC data was provided; absence of KEV means there is no confirmation of active exploitation, and no public exploit was identified at time of analysis. Net: this is a credible, high-priority flaw for anyone running the plugin - unauthenticated RCE is the worst-case outcome and the leaked-nonce condition is commonly met on active sites that run bulk optimisation - but the exploitation signal is currently potential rather than observed, so prioritize patching without treating it as confirmed in-the-wild exploitation.

An unauthenticated attacker reads the world-readable file under wp-content/uploads/ that the plugin writes whenever a bulk image-optimisation batch pauses, recovering the tenwebio_rest REST nonce (valid for anonymous visitors because it is generated in a cron/loopback context with user ID 0). Using that nonce, the attacker calls the compressCustom function with a malicious page_id and, because file type and extension validation are missing, uploads an executable PHP file, then requests it to achieve remote code execution. No public exploit was identified at time of analysis, but the full chain is described in detail by the Wordfence advisory and the referenced source code.