What the vulnerability does
01Description
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the get_cache_dir_for_page_from_url() function in all versions up to, and including, 2.32.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary folders on the server, which can easily lead to a loss of data or a denial of service condition.
Explanation of Vulnerability in Simple Terms
02Summary
10Web Booster versions up to 2.32.7 contain a path traversal vulnerability that allows authenticated users to modify or delete arbitrary files on the site. An attacker with low-level access can bypass file restrictions and alter critical site files, potentially compromising site integrity and availability. Update to a version newer than 2.32.7 immediately.
What an attacker can do
03Attacker Capabilities
Modify or delete arbitrary files on the site, including core configuration and data files.
Potential impact on your site
04Site Impact
Site files and configuration can be altered or destroyed by any low-privilege user, leading to site defacement or downtime.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account (subscriber, contributor, or equivalent) on the site.
Key dates
06Disclosure timeline
December 6, 2025
CVE published
April 8, 2026
Record updated
