The 10Web Booster plugin contains a flaw in the get_cache_dir_for_page_from_url() routine that fails to validate file paths correctly. This weakness allows an attacker with authenticated Subscriber-level access or higher to specify an arbitrary path, causing the server to delete any folder for which the user has filesystem rights. The resulting loss of folders can erase website data, break site functionality, or render the site unavailable. The root cause is a path‑traversal vulnerability (CWE‑22).

WordPress sites running the 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin, with any version up to and including 2.32.7. The vulnerability is present in all versions of the plugin through 2.32.7; newer releases have been fixed.

The container has a CVSS score of 9.6, indicating high severity. The EPSS score of < 1% suggests that exploitation is currently not common, but the vulnerability remains actively exploitable for any authenticated user with Subscriber or higher role. The flaw is not listed in the CISA KEV catalog, so there is no known active exploitation campaign, yet the combination of a high impact and a viable attack path warrants urgent attention. An attacker must first authenticate to the WordPress admin area with a Subscriber or higher role, then trigger the deletion via the two_clear_page_cache function, which can target arbitrary directories on the server.