{"id":"CVE-2026-103896","kind":"vulnerability","aliases":["CVE-2026-103896"],"related":[],"title":"10Web Booster WordPress plugin: unauthenticated path traversal writes cache files","description":"The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::get_cache_file_dir() function concatenating raw, unsanitized $_GET parameter names and values into the on-disk cache path, and the cache_content() sink calling mkdir() and file_put_contents() on the result with no realpath containment check — unlike the sibling delete_page_cache(), which does perform one. This makes it possible for unauthenticated attackers to create arbitrary directories (mode 0777, recursively) outside the cache root and write a cached page into them. The write is LIMITED: the filename is always 'source.html', so the extension is fixed, and the content is the rendered page buffer rather than attacker-supplied data. PHP files cannot be written and code execution is not possible; the demonstrated impact is cache poisoning and arbitrary directory creation.","summary":"The 10Web Booster WordPress plugin, up to and including 2.34.5, builds its cache file path from unsanitized GET parameters. An unauthenticated attacker can create directories outside the cache root and write a rendered page to them as source.html, which allows cache poisoning but not code execution.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","wordpress"],"not_affected_if":["newer-version","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin plugin list or with `wp plugin get 10web-booster --field=version` (slug assumed; confirm it).\n- Look for a cache directory outside the expected cache root containing `source.html` files.","fix":"- Update the 10Web Booster plugin to a version later than `2.34.5`; the exact fixed version is unknown from these sources.","status":"open","published_at":"2026-10-16T06:17:03+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:25:10+00:00","updated_at":"2026-10-25T03:25:10+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:25:10Z","model":"claude-haiku-5-5","output":{"fix":"- Update the 10Web Booster plugin to a version later than `2.34.5`; the exact fixed version is unknown from these sources.","reach":"internet","title":"10Web Booster WordPress plugin: unauthenticated path traversal writes cache files","impact":"medium","summary":"The 10Web Booster WordPress plugin, up to and including 2.34.5, builds its cache file path from unsanitized GET parameters. An unauthenticated attacker can create directories outside the cache root and write a rendered page to them as source.html, which allows cache poisoning but not code execution.","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted","php"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker poisons cached pages and creates arbitrary directories; no code execution.","analyst_note":"Confirm the fixed version and whether the page cache is on by default, from the NVD entry or the plugin's changelog.","how_to_check":"- Check the installed plugin version in the WordPress admin plugin list or with `wp plugin get 10web-booster --field=version` (slug assumed; confirm it).\n- Look for a cache directory outside the expected cache root containing `source.html` files.","needs_analyst":true,"not_affected_if":["plugin-not-installed","newer-version"],"who_is_affected":"Sites running the 10Web Booster plugin at version `2.34.5` or earlier that have its page cache active, where the cache path is built from request parameters. Sites without the plugin, or running a newer release, can skip it. The sources do not say whether a non-default setting is required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00065,"input_tokens":3563,"output_tokens":587,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-103896':13A,16A '-2026':12A,15A '0777':166C '10web':1A,24B,70C '2.34.5':32B,98C 'allow':62B 'alway':186C 'arbitrari':163C,225C 'attack':44B,160C,204C 'attacker-suppli':203C 'booster':2A,25B,71C 'buffer':200C 'build':33B 'cach':9A,35B,50B,63B,75C,106C,123C,127C,149C,170C,175C,222C 'call':130C 'cannot':209C 'check':143C 'code':67B,213C 'concaten':110C 'contain':142C 'content':128C,135C,195C 'creat':46B,162C 'creation':227C 'cve':11A,14A 'data':206C 'delet':147C 'demonstr':219C 'dir':108C 'directori':47B,164C,226C 'disk':122C 'due':101C 'execut':68B,214C 'extens':190C 'file':10A,36B,87C,107C,133C,208C 'filenam':184C 'fix':192C 'function':109C 'get':40B,105C,113C 'host':21B 'impact':220C 'includ':31B,97C 'limit':86C,182C 'make':155C 'mkdir':131C 'mode':165C 'name':115C 'on-disk':120C 'one':153C 'optim':74C,78C 'optimizerwebpagecach':104C 'outsid':48B,168C 'packag':17B 'page':56B,76C,148C,176C,199C 'paramet':41B,114C 'path':6A,37B,90C,124C 'perform':152C 'php':18B,207C 'plugin':4A,27B,79C 'poison':64B,223C 'possibl':157C,217C 'put':134C 'rather':201C 'raw':111C 'realpath':141C 'recurs':167C 'render':55B,198C 'result':138C 'root':51B,171C 'self':20B 'self-host':19B 'sibl':146C 'sink':129C 'source.html':60B,187C 'speed':73C,77C 'suppli':205C 'travers':7A,91C 'unauthent':5A,43B,159C 'unlik':144C 'unsanit':39B,112C 'valu':117C 'version':93C 'via':89C 'vulner':83C 'websit':72C 'wordpress':3A,22B,26B,81C 'write':8A,53B,88C,173C,180C 'written':211C","nicknames":[],"mitigations":[],"who_affected":"Sites running the 10Web Booster plugin at version `2.34.5` or earlier that have its page cache active, where the cache path is built from request parameters. Sites without the plugin, or running a newer release, can skip it. The sources do not say whether a non-default setting is required.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T06:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103896","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103896","severity":null,"published_at":"2026-10-16T06:17:03+00:00","modified_at":"2026-10-16T15:17:02+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}