10Web Booster EUVD-2025-201539

Exploitation requires an authenticated WordPress account with Subscriber-level access or above (PR:L) on a site running 10Web Booster version ≤2.32.7, and the ability to invoke the plugin's cache-directory resolution path that calls get_cache_dir_for_page_from_url() with attacker-controlled input lacking sufficient file path validation (CWE-22). No user interaction is needed (UI:N) and the attack is network-reachable (AV:N) at low complexity (AC:L). The primary limiting factor is the authentication requirement: the site must permit the attacker to obtain at least a Subscriber account (e.g., open user registration or a membership/multi-author configuration); sites that disable self-registration and tightly control low-privilege accounts substantially reduce exposure. Impact is destructive (folder deletion → data loss / DoS) rather than disclosure, so confidentiality is not affected.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1 High) describes a remotely reachable, low-complexity flaw that requires only low-privilege authentication (Subscriber-level per the description) and no user interaction, with high integrity and availability impact but no confidentiality impact - consistent with arbitrary folder deletion causing data loss or denial of service rather than data exposure. Despite the High score, the EPSS probability is only 0.08% (24th percentile), indicating a low modeled likelihood of exploitation in the near term. There is no CISA KEV listing and no public exploit code identified in the provided data, so this is best characterized as no public exploit identified at time of analysis. No SSVC decision data was provided. The signals are internally consistent (network vector, low privilege, destructive impact) and point to a genuine but not emergency priority: a real, patch-worthy issue - particularly on multi-author or membership WordPress sites where low-privilege accounts are common - but currently lacking evidence of active or widespread exploitation. The low EPSS alongside the absence of KEV/POC suggests opportunistic rather than mass exploitation risk at present.

An attacker registers or obtains a Subscriber-level account on a WordPress site running 10Web Booster (self-registration is common on many sites), then sends a crafted request to the plugin's cache-clearing functionality whose unvalidated URL/path input reaches get_cache_dir_for_page_from_url(), causing path traversal that resolves to a directory outside the intended cache folder. The server deletes that arbitrary folder, destroying site files or triggering a denial-of-service condition. No public proof-of-concept was identified at time of analysis; exploitation is low-complexity (AC:L) and requires no user interaction.