The 10Web Booster plugin for WordPress suffers from a path traversal flaw in its cache path construction. Unsanitized query‑string parameters are concatenated into the on‑disk cache directory, allowing an unauthenticated attacker to create directories with 0777 permissions and write a file named source.html into them. Because the content is always the rendered page buffer and PHP files cannot be uploaded, code execution is not feasible. The primary impact is cache poisoning and arbitrary directory creation, which could lead to confusing user experiences or subversion of the caching mechanism.

The vulnerability affects the 10Web Booster – Website speed optimization, Cache & Page Speed optimizer WordPress plugin, versions 2.34.5 and earlier. Updating to any release newer than 2.34.5 removes the exploit path.

The CVSS score of 7.5 indicates a high severity level. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting exploitation likelihood is uncertain but possible. The attack vector is inferred to be a network‑based, unauthenticated HTTP request that manipulates query‑string parameters to traverse the cache directory. Given the limited nature of the file write, an exploit would mainly allow destructive cache configuration rather than arbitrary code execution.