CVE-2026-108587

Executive Summary

CVE-2026-108587 is a critical (CVSS 9.8) unauthenticated arbitrary file upload vulnerability in the 10Web Booster WordPress plugin affecting all versions up to and including 2.34.10. The flaw chains a missing file-type/extension filter on the page_id parameter in the compressCustom function with a world-readable leaked REST nonce (tenwebio_rest), enabling unauthenticated attackers to upload executable files and achieve remote code execution. Successful exploitation fully compromises the host, its data, and any co-hosted workloads.

Technical Analysis

The vulnerability resides in the 10Web Booster plugin's compressCustom function. According to the NVD description, the function performs an arbitrary file upload because it lacks two controls that are normally required for safe upload handling:

1. Missing file-type validation. The upload path does not validate the MIME type or content of the uploaded file.
2. Missing extension filtering. The upload path does not restrict the file extension, meaning files with executable extensions (e.g., .php) can be written to a web-accessible location.

These two omissions are both bound to the page_id parameter, which is the parameter through which an attacker influences the upload.

The second component of the chain is an authentication bypass. The plugin exposes a REST endpoint protected by a nonce named tenwebio_rest. This nonce is automatically serialized to a world-readable file under wp-content/uploads/ whenever a bulk optimisation batch pauses. Because the nonce is generated in a cron/loopback context with a user ID of 0, it is treated as valid for unauthenticated visitors. An attacker who can read that file (or otherwise obtain the nonce) can present it to the REST endpoint and bypass authentication checks.

Combined, the two flaws yield a fully unauthenticated remote code execution primitive: a leaked, universally-valid nonce defeats authentication, and an unrestricted upload (CWE-434) permits the placement of executable content, which the web server then executes when requested.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects network reachability, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality, integrity, and availability impact — a maximum-impact profile consistent with RCE.

No public proof-of-concept, Nuclei template, or exploit code was available at the time of writing. The attack chain described below is inferred from the vulnerability class and the NVD-supplied mechanism; no specific code patterns or function names beyond those in the description are asserted.

Exploitation Scenarios

1. Reconnaissance / target identification. The attacker enumerates WordPress installations and identifies hosts running a vulnerable version of 10Web Booster (<= 2.34.10) by fingerprinting plugin assets, version strings, or plugin-specific REST behaviour. No credentials or prior access are required.

2. Obtaining the nonce. The attacker retrieves the world-readable leaked nonce file under wp-content/uploads/, from which the tenwebio_rest nonce is recoverable. Because the nonce is generated with a user ID of 0 in a cron/loopback context, it is valid for unauthenticated visitors. This step converts an authenticated REST call into an unauthenticated one.

3. Triggering the flaw. With the valid nonce, the attacker calls the plugin's REST handler that routes into compressCustom, supplying a crafted page_id parameter and an uploaded file. The function neither validates the file type nor filters the extension, so the attacker's file is accepted and written to a web-accessible location.

4. Execution / post-exploitation. The attacker requests the uploaded file over HTTP. Because executable extensions are not blocked, the file executes in the web server context, yielding remote code execution. From that position the attacker can install persistence, pivot to the database and WordPress admin functions, exfiltrate data, or use the host as a lateral-movement staging point.

Because no public exploit exists, the precise request bodies and payload shapes are not documented here. The chain is a class-level inference: nonce leak -> authentication bypass -> unrestricted upload -> RCE.

Impact Assessment

Impacts are maximum across all three CVSS metrics:

• Confidentiality (High): Potential exposure of the WordPress database, user records, secrets/config, and any co-hosted application data.
• Integrity (High): Full control of site content, plugin/code modifications, and persistence mechanisms.
• Availability (High): Ability to deface, encrypt, or take the site offline.

Blast radius extends beyond the WordPress site itself: a web-server-context shell typically grants access to filesystems, environment variables, credentials, and reachable internal services. The public internet exposure of WordPress and the absence of authentication requirements make this a high-priority target for automated scanning.

Detection Guidance

Sigma Rule

title: 10Web Booster Arbitrary File Upload via compressCustom
id: c5a9a1de-73ee-4e63-9a5e-108587b00001
status: experimental
description: Detects HTTP requests to the 10Web Booster REST endpoint abusing compressCustom with a nonce parameter, indicative of CVE-2026-108587.
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-query|contains:
      - 'rest_route=/'
      - 'wp-json'
  selection_plugin:
    cs-uri-query|contains: 'tenweb'
  selection_nonce:
    cs-uri-query|contains:
      - 'tenwebio_rest'
      - 'nonce='
  selection_upload:
    c-uri|contains: 'compressCustom'
  condition: selection_path and selection_plugin and selection_nonce
falsepositives:
  - Legitimate plugin bulk optimisation traffic
level: high

YARA Rule

rule CVE_2026_108587_10web_booster_upload
{
    meta:
        author = "Threat Intelligence"
        description = "Detects web-access-log and artifact indicators for CVE-2026-108587"
        cve = "CVE-2026-108587"
        date = "2026-01-01"
    strings:
        $s1 = "compressCustom" ascii nocase
        $s2 = "tenwebio_rest" ascii nocase
        $s3 = "page_id" ascii nocase
        $s4 = "wp-content/uploads" ascii nocase
    condition:
        (uint16(0) == 0x504B or $s1) and any of ($s1, $s2) and any of ($s1, $s2, $s3, $s4)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-108587 10Web Booster compressCustom Arbitrary File Upload Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"compressCustom"; nocase; http.request_body; content:"page_id"; nocase; http.request_body; content:"tenwebio_rest"; nocase; classtype:web-application-attack; reference:cve,2026-108587; sid:1085870; rev:1;)

Elastic Detection

any where
  process.name : ("php", "php-fpm", "httpd", "apache2", "nginx") and
  file.path : ("/wp-content/uploads/*", "/var/www/html/wp-content/uploads/*")
  and file.extension : ("php", "phtml", "php5", "php7", "phar")

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="*compressCustom*" OR uri_query="*compressCustom*"
| where match(uri_query, "(?i)tenwebio_rest") OR match(uri_query, "(?i)page_id")
| stats count, values(uri_path) as paths, values(clientip) as src_ips by host
| where count > 0

Wazuh OSSEC Rule

<group name="web,wordpress,10web,">
  <rule id="108587" level="12">
    <if_sid>31100</if_sid>
    <match>compressCustom</match>
    <match>page_id</match>
    <description>CVE-2026-108587: 10Web Booster compressCustom arbitrary file upload attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)).

1. Immediate mitigations. Restrict or block external access to the plugin's REST endpoints; in particular, block requests that reference compressCustom at the WAF or reverse proxy. Deny HTTP execution within wp-content/uploads/ (php_flag engine off / Nginx location deny of PHP handling) to neutralise the upload-to-RCE conversion. Rotate/expire exposed tenwebio_rest nonces and re-secure the leaked nonce file under wp-content/uploads/.

2. Patch / upgrade steps. Apply whatever fix the vendor publishes for versions after 2.34.10. Because patch confidence is low and the NVD reference is unverified, confirm the fix with the vendor advisory before relying on it; upgrade verification should include retesting the compressCustom upload path.

3. Long-term hardening. Enforce MIME and extension validation on all upload endpoints, generate nonces with authenticated user contexts only, and never serialize secrets to web-readable paths. Add integrity monitoring over wp-content/uploads/ and a WAF signature for the compressCustom upload pattern.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-108587
• MITRE CWE-434: Unrestricted Upload of File with Dangerous Type
• 10Web Booster plugin information (WordPress.org plugin repository)
• CISA KEV Catalog: not listed (CVE-2026-108587 absent at time of writing)

No public proof-of-concept or exploit code is available; no threat-actor campaign has been publicly attributed to this CVE at this time.