PT-2025-49354 · WordPress · 10Web Booster

Angus Girvan · Published 2025-12-06 · Updated 2025-12-11 · CVE-2025-13377

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions 10Web Booster versions prior to 2.32.8

Description The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is susceptible to arbitrary folder deletion due to inadequate file path validation within the get cache dir for page from url() function. Authenticated attackers possessing Subscriber-level access or higher can delete arbitrary folders on the server, potentially resulting in data loss or a denial of service. The get cache dir for page from url() function is vulnerable.

Recommendations Update 10Web Booster to version 2.32.8 or later.

Fix

DoS

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-13377

Affected Products

10Web Booster

References · 12

• https://osv.dev/vulnerability/CVE-2025-13377 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/3402434/tenweb-speed-optimizer · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-13377 · Security Note
• https://t.me/cveNotify/145509 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/f8bcf51a-36ee-4d4d-b9d6-d9db0dafd791?source=cve · Note
• https://twitter.com/CveFindCom/status/1997209155656908819 · Twitter Post
• https://twitter.com/CVEnew/status/1997203238140133761 · Twitter Post
• https://t.me/CVEtracker/38998 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1997276288893989210 · Twitter Post
• https://t.me/cveNotify/145004 · Telegram Post
• https://twitter.com/offseq/status/1997199923205623857 · Twitter Post
• https://twitter.com/cracbot/status/1999071714580582861 · Twitter Post