Software component issue could allow unintended commands to run
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the…
What happened
- The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::get_cache_file_dir() function concatenating raw, unsanitized $_GET parameter names and values into the on-disk cache path, and the cache_content() sink calling mkdir() and file_put_contents() on the result with no realpath containment check — unlike the sibling delete_page_cache(), which does perform one. This makes it possible for unauthenticated attackers to create arbitrary directories (mode 0777, recursively) outside the cache root and write a cached page into them. The write is LIMITED: the filename is always 'source.html', so the extension is fixed, and the content is the rendered page buffer rather than attacker-supplied data. PHP files cannot be written and code execution is not possible; the demonstrated impact is cache poisoning and arbitrary directory creation.Security Advisory CVE-2026-103896
- The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::getcachefiledir() function concatenating raw, unsanitized $GET parameter names…Advisory description (CVE-2026-103896)
Contributing factors stated by the source
- The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::getcachefiledir() function concatenating raw, unsanitized $GET parameter names…
The failure pattern
Watch the pattern: Privileged action without an enforceable approval gate
Related standards
CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.
Building something similar?
Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.
Incidents with the same pattern
GitHub Actions injection leaks Nx's npm token; malicious packages use local AI coding tools to hunt for secrets (2025)
A pull-request title validation workflow used pullrequesttarget, which runs with repository secrets, and echoed the unsanitized PR title, creating an injection point; the workflow's token also had read/write permissions.
GitHub's RSA SSH host private key briefly exposed in a public repository (2023)
GitHub.com's RSA SSH private key was briefly exposed in a public GitHub repository.
Zillow winds down its algorithmic home-buying business after price forecasts miss (2021)
Machine learning pricing models drifted during market volatility; automated purchasing bought homes above value resulting in $540M inventory write-down.
Retail broker failed best-execution reviews while taking high payment for order flow (Robinhood, SEC 2020)
From July 2016 to June 2019 the broker received high payment for order flow but did not conduct adequate, regular and rigorous reviews of execution quality on customer orders.
SUNBURST: a backdoor inserted into SolarWinds Orion builds reaches customers (2020)
Compromised build server injected SUNBURST malware into compiler memory during build process; distributed to 18,000 customers.
Confusing loan-system interface leads Citibank to wire nearly $900 million in principal to Revlon lenders (2020)
Unintuitive Flexcube interface required checking obscure override box; bank accidentally wired $894M of proprietary funds to Revlon lenders.