This vulnerability is a PHP Object Injection flaw that allows an attacker to manipulate serialized PHP objects in the 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin. By supplying crafted input that is processed with PHP's unserialize functionality, an attacker could execute arbitrary code on the affected WordPress site, potentially leading to full server compromise, data theft, or defacement.

The flaw affects the 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress versions 2.33.6 and earlier. Users running these plugin versions on any WordPress installation are exposed to the risk until the plugin is updated to version 2.34.0 or later.

The CVSS score of 8.8 classifies this vulnerability as high severity. The EPSS score is not available, indicating that current public data does not quantify exploitation likelihood, but the absence of a KEV listing does not mitigate the obvious potential for exploitation. Based on the description, the likely attack vector is a remote, unauthenticated request to the plugin’s entry point; an attacker must supply specially crafted payloads that are deserialized by the plugin. Once the object injection succeeds, the attacker can gain remote code execution on the server. The necessary attack prerequisites include access to the website’s public URLs and the ability to send arbitrary data to the plugin’s endpoints.