---
id: "CVE-2026-103896"
kind: "vulnerability"
aliases: ["CVE-2026-103896"]
title: "10Web Booster WordPress plugin: unauthenticated path traversal writes cache files"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "self-hosted", "wordpress"]
not_affected_if: ["newer-version", "plugin-not-installed"]
published_at: "2026-10-16T06:17:03+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T03:25:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103896", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# 10Web Booster WordPress plugin: unauthenticated path traversal writes cache files

The 10Web Booster WordPress plugin, up to and including 2.34.5, builds its cache file path from unsanitized GET parameters. An unauthenticated attacker can create directories outside the cache root and write a rendered page to them as source.html, which allows cache poisoning but not code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin plugin list or with `wp plugin get 10web-booster --field=version` (slug assumed; confirm it).
- Look for a cache directory outside the expected cache root containing `source.html` files.

## Fix

- Update the 10Web Booster plugin to a version later than `2.34.5`; the exact fixed version is unknown from these sources.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103896

## From the sources

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::get_cache_file_dir() function concatenating raw, unsanitized $_GET parameter names and values into the on-disk cache path, and the cache_content() sink calling mkdir() and file_put_contents() on the result with no realpath containment check — unlike the sibling delete_page_cache(), which does perform one. This makes it possible for unauthenticated attackers to create arbitrary directories (mode 0777, recursively) outside the cache root and write a cached page into them. The write is LIMITED: the filename is always 'source.html', so the extension is fixed, and the content is the rendered page buffer rather than attacker-supplied data. PHP files cannot be written and code execution is not possible; the demonstrated impact is cache poisoning and arbitrary directory creation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_