What’s Vulnerable › Vulnerabilities
CVE-2026-82195: 10Web Booster < 2.34.0 - Unauthenticated Connection Secret Disclosure and Deletion
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-24 · updated 2026-09-24
- Weakness: CWE-862
Description
The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud connection, disclosing that secret to unauthenticated visitors and letting them delete it repeatedly, preventing an administrator from completing a legitimate connection.
Affected products
- 10Web Booster – Website speed optimization, Cache & Page Speed optimizer: before 2.34.0 — fixed in 2.34.0
How to fix
Upgrade to a fixed version: 10Web Booster – Website speed optimization, Cache & Page Speed optimizer 2.34.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-82195 or the next vulnerability affects your stack