10web Booster
Monthly
Missing authorization in the 10Web Booster WordPress plugin before 2.34.0 exposes an unauthenticated routine that issues the plugin's cloud-connection shared secret, allowing any anonymous visitor to read that secret and then repeatedly delete it. The practical impact is limited to confidentiality of the cloud credential and availability of the legitimate administrator's cloud connection: an attacker cannot achieve code execution or broader site compromise, but they can disclose the secret and block an administrator from completing a valid 10Web connection. Exploitation requires no authentication or user interaction per the assessed vector (AV:N/AC:L/PR:N/UI:N), publicly available exploit code exists, and no confirmed active exploitation has been reported (CISA SSVC Exploitation: none); this is a moderate-priority issue whose real-world ceiling sits well below its 6.5 base score.
Arbitrary folder deletion in the 10Web Booster WordPress plugin, affecting all versions up to and including 2.32.7, lets an authenticated attacker with Subscriber-level access or higher delete folders of their choosing on the underlying server via crafted input into the plugin's cache-directory resolution logic, resulting in data loss or a denial-of-service condition. The flaw is network-reachable at low complexity and requires no user interaction, but low-privilege authentication is the key gating factor; confidentiality is unaffected while integrity and availability impacts are high, yielding a CVSS 3.1 base score of 8.1. There is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis, and EPSS estimates only about 0.08% probability of exploitation in the next 30 days (24th percentile); a vendor patch is available.
The 10Web Booster WordPress plugin before 2.24.18 does not validate the option name given to some AJAX actions, allowing unauthenticated users to delete arbitrary options from the database, leading. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Missing authorization in the 10Web Booster WordPress plugin before 2.34.0 exposes an unauthenticated routine that issues the plugin's cloud-connection shared secret, allowing any anonymous visitor to read that secret and then repeatedly delete it. The practical impact is limited to confidentiality of the cloud credential and availability of the legitimate administrator's cloud connection: an attacker cannot achieve code execution or broader site compromise, but they can disclose the secret and block an administrator from completing a valid 10Web connection. Exploitation requires no authentication or user interaction per the assessed vector (AV:N/AC:L/PR:N/UI:N), publicly available exploit code exists, and no confirmed active exploitation has been reported (CISA SSVC Exploitation: none); this is a moderate-priority issue whose real-world ceiling sits well below its 6.5 base score.
Arbitrary folder deletion in the 10Web Booster WordPress plugin, affecting all versions up to and including 2.32.7, lets an authenticated attacker with Subscriber-level access or higher delete folders of their choosing on the underlying server via crafted input into the plugin's cache-directory resolution logic, resulting in data loss or a denial-of-service condition. The flaw is network-reachable at low complexity and requires no user interaction, but low-privilege authentication is the key gating factor; confidentiality is unaffected while integrity and availability impacts are high, yielding a CVSS 3.1 base score of 8.1. There is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis, and EPSS estimates only about 0.08% probability of exploitation in the next 30 days (24th percentile); a vendor patch is available.
The 10Web Booster WordPress plugin before 2.24.18 does not validate the option name given to some AJAX actions, allowing unauthenticated users to delete arbitrary options from the database, leading. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.