10Web Booster EUVD-2026-85797

No special conditions - remote unauthenticated exploitation against default configurations of the 10Web Booster WordPress plugin before 2.34.0. The vulnerable behavior is the plugin's own routine that issues and manages the cloud-connection shared secret, which lacks any access restriction, so any anonymous visitor can reach it. The only meaningful limiting factor is impact scope: exploitation yields disclosure of the cloud shared secret and repeatable deletion that denies legitimate admin cloud connection, not code execution or broader site compromise; the site must have the plugin installed and be attempting (or intending) to use the 10Web cloud connection for the availability impact to matter.

This is a genuine but moderate-priority issue best characterized as high-CVSS-relative-to-real-impact-ceiling rather than a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, 6.5 MEDIUM) shows the flaw is remotely reachable, trivial to trigger, and requires no authentication or user interaction - the worst-case ingredients for exploitation ease - but the technical impact is deliberately bounded to C:L (disclosure of one shared secret) and A:L (repeated deletion denies the cloud-connection feature). There is no code execution, no data write, and no full-site compromise. SSVC corroborates this: exploitation=none (no observed in-the-wild activity), automatable=yes (unauthenticated network access with low complexity is scriptable), technical impact=partial (matches the C:L/A:L scoping). A public exploit exists (WPScan) and a vendor patch is available, but there is no EPSS score and no CISA KEV listing provided, so there is no evidence of active exploitation. The signals are internally consistent: easy-to-exploit and automatable, yet limited-impact and not-yet-exploited. Priority driver is the low exploitation barrier plus public POC on a widely-used WordPress plugin; the dampener is the capped impact (secret leak + connection-setup denial-of-service, not RCE).

An unauthenticated attacker sends a request to the unprotected 10Web Booster endpoint that issues the plugin's cloud-connection shared secret, reading the secret and then repeatedly invoking the deletion routine. This both leaks the authenticating secret and prevents any administrator from completing a legitimate 10Web cloud connection, creating a persistent denial of the plugin's cloud functionality. A public exploit is available via WPScan, and the network/low-complexity/no-auth vector makes the attack easily automatable across many sites.