Critical · published December 6, 2025
🚨 A Subscriber-level user could delete any folder on your server! This critical flaw in the 10Web Booster plugin means attackers can cause absolute chaos with a few clicks. 🔥 Think of this vulnerability like a careless hotel staff member who just hands out spare keys without checking who’s asking. If they don’t verify who can access which room, someone might just waltz in and take or destroy your prized possessions! An attacker could delete important folders, potentially leading to massive data loss or even taking your website offline completely. This could be devastating for your business, as it opens the door for unauthorized actions and disrupts your online presence.
Think of this vulnerability like a careless hotel staff member who just hands out spare keys without checking who’s asking. If they don’t verify who can access which room, someone might just waltz in and take or destroy your prized possessions! The vulnerability stems from insufficient file path validation in the `get_cache_dir_for_page_from_url()` function, allowing authenticated users with Subscriber-level access and above to delete arbitrary folders on the server.
An attacker could delete important folders, potentially leading to massive data loss or even taking your website offline completely. This could be devastating for your business, as it opens the door for unauthorized actions and disrupts your online presence. To protect your site, immediately update the 10Web Booster plugin to version 2.32.8 or later. Additionally, review user permissions and consider restricting access for lower-level users. Regularly back up your data to prevent loss! You've got this! Follow these steps, and you'll be a security hero in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| 10web/10web_booster | < 2.32.11 | 2.32.11 |