CVE-2025-13377: falha crítica em 10Web Booster – Website speed optimization…
10Web Booster <= 2.32.7 - Authenticated (Subscriber+) Arbitrary Folder Deletion via two_clear_page_cache
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.6epss 0.5%
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the get_cache_dir_for_page_from_url() function in all versions up to, and including, 2.32.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary folders on the server, which can easily lead to a loss of data or a denial of service condition.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
CVEs relacionadas — 10Web Booster – Website speed optimization…
No mesmo produto, das mais perigosas para as menos.
CVE-2026-108587CRITICAL10Web Booster <= 2.34.10 - Unauthenticated Arbitrary File Upload via 'page_id' ParameterEPSS 0.9%CVE-2026-103896HIGH10Web Booster <= 2.34.5 - Unauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache PathEPSS 0.5%CVE-2026-107742HIGH10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author NameEPSS 0.2%