10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.34.5 - Unauthenticated Path Traversal via Page Cache Path
- ID
- WPSEC-2026-0375
- Plugin
- 10Web Booster – Website speed optimization, Cache & Page Speed optimizer (tenweb-speed-optimizer)
- Affected
- all versions before 2.34.8
- Remediation
- Update to 2.34.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-22
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- 10Web Booster – Website speed optimization, Cache & Page Speed optimizer on WPSec AttackSurface
- Fix released
- Published
Description
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Path Traversal in its page cache in all versions up to, and including, 2.34.5. This is due to the page cache path being built from unsanitized request data, including query parameter values (such as the search parameter), the wcml_client_currency cookie and the per-user cache login cookie. This makes it possible for unauthenticated attackers to supply '../' sequences that make the plugin create directories and write its cache files (source.html, headers.json and source.html.gzip, containing the rendered page) outside the page cache directory, for example to store a search results page as the cached copy of another page that is not currently cached. The page cache must be enabled, which is the default on connected sites not hosted by 10Web.
References
- https://wpsec.com/vuln/WPSEC-2026-0375/
- https://plugins.svn.wordpress.org/tenweb-speed-optimizer/tags/2.34.8/
- https://wordpress.org/plugins/tenweb-speed-optimizer/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS