10Web Booster EUVD-2026-102671

Requires that 10Web Booster (≤2.34.5) is installed and active with its page-caching path reachable, so that attacker-supplied GET parameter names and values flow into OptimizerWebPageCache::get_cache_file_dir() and reach the cache_content() sink. No authentication, user interaction, or special privileges are needed (PR:N/UI:N), and default configurations are affected once caching is operative. Exploitation is LIMITED by design: the written filename is fixed ('source.html'), the file extension cannot be changed, and the content is the server-rendered page buffer rather than attacker-controlled data - so no PHP/executable file can be planted and the practical outcome is bounded to arbitrary directory creation and cache poisoning. Successful out-of-root writes also depend on filesystem permissions of the PHP/web-server user at the traversed target path.

Signals conflict on severity. The input CVSS of 7.5 (AV:N/AC:L/PR:N/UI:N with I:H) correctly captures that this is remotely reachable by unauthenticated attackers at low complexity, but the I:H rating overstates impact: the description explicitly constrains the write to a fixed filename ('source.html'), a non-attacker-controlled content (the rendered page buffer), and no PHP/code-execution capability. The realistic impact is arbitrary recursive directory creation (mode 0777) outside the cache root plus cache poisoning - an integrity issue, but a limited one (I assess I:L, not I:H). No EPSS score, KEV listing, or public POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The 'RCE' tag in the input directly contradicts the description, which states code execution is not possible. Net: a legitimate unauthenticated flaw worth patching, but not a critical-impact or actively-exploited emergency; prioritize based on exposure of the affected plugin rather than on the raw 7.5 score.

An unauthenticated attacker sends a crafted HTTP request to a WordPress site running 10Web Booster ≤2.34.5, embedding path-traversal sequences in the GET parameter names/values that get_cache_file_dir() concatenates raw into the on-disk cache path. Because cache_content() calls mkdir() and file_put_contents() with no realpath containment check (unlike the sibling delete_page_cache()), directories are created and a 'source.html' cache file is written outside the intended cache root. No public exploit code is identified at time of analysis; the demonstrated impact is cache poisoning and arbitrary directory creation, not code execution.