The plugin contains an arbitrary file upload flaw that allows attackers to upload files without restriction. Because the page_id parameter lacks file type and extension validation, and the plugin writes a REST nonce to a world‑readable file, the upload request can be authenticated by any visitor. Once a file with executable code is uploaded it can be executed via the plugin’s REST interface, giving the attacker full remote code execution on the WordPress site.

All installs of 10Web Booster (Website speed optimization, Cache & Page Speed optimizer) with version 2.34.10 or earlier are affected. The flaw is present in the compressCustom function used by the plugin for image optimisation. The vulnerability applies to the WordPress plugin as a whole, regardless of the site domain or theme.

The CVSS score of 9.8 highlights a critical severity. While EPSS is not provided, the lack of a KEV listing does not diminish the potential for exploitation. The attack vector is inferred to be an unauthenticated HTTP request to the REST API, requiring the attacker to trigger generation of a world‑readable nonce file through a scheduled bulk optimisation pause on the site. Once the nonce is available, the attacker can upload and run arbitrary code, yielding full control over the site. The diversity of file types that can be uploaded and the absence of authentication checks make this vulnerability highly exploitable.