CVE-2026-82195 in Booster Plugin
Summary
by MITRE • 09/24/2026
The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud connection, disclosing that secret to unauthenticated visitors and letting them delete it repeatedly, preventing an administrator from completing a legitimate connection.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified in versions of the 10Web Booster WordPress plugin prior to version 2.34.0 represents a critical failure in access control mechanisms within the application's cloud connectivity module. This flaw specifically affects the routine responsible for generating and issuing shared secrets, which are essential cryptographic tokens used to authenticate the connection between the local WordPress installation and the 10Web cloud infrastructure. Under normal operational parameters, such sensitive operations must be strictly gated behind authentication checks to ensure that only authorized administrators can initiate or manage these connections. However, due to insufficient validation of user capabilities, this specific endpoint remains accessible to unauthenticated visitors, effectively bypassing standard security boundaries inherent in WordPress core functionality.
From a technical perspective, the root cause lies in the absence of proper capability verification before executing logic related to secret generation and management. In typical web application architectures, especially those built on content management systems like WordPress, any action that modifies state or exposes sensitive configuration data must verify that the requesting user possesses administrative privileges. The failure to implement this check allows external actors with no valid session or login credentials to interact directly with the API endpoint responsible for issuing shared secrets. This lack of restriction transforms a routine administrative function into an open interface accessible by anyone on the internet, fundamentally compromising the integrity of the authentication handshake process required for cloud integration.
The operational impact of this vulnerability is twofold and significantly detrimental to site administrators. First, unauthenticated attackers can retrieve the shared secret intended for legitimate use, potentially allowing them to impersonate the server in communications with the 10Web infrastructure if other security layers are also compromised. More immediately, however, the flaw allows malicious actors to repeatedly delete or invalidate these secrets without authorization. By continuously issuing requests that trigger the deletion of valid credentials, attackers can create a denial-of-service condition specific to the plugin's functionality. This prevents legitimate administrators from establishing or maintaining their cloud connection, effectively locking them out of essential management features and disrupting any automated processes dependent on this integration.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-284, which describes Improper Access Control, as well as CWE-359 regarding Exposure of Private Information to an Unauthorized Actor. In the context of the MITRE ATT&CK framework for enterprise security, this behavior corresponds to techniques involving unauthorized access and potential disruption of service through credential manipulation. The ability to repeatedly delete authentication tokens falls under tactics related to Impact or Defense Evasion, depending on whether the goal is simply to disrupt operations or to obscure the attacker's presence by forcing repeated re-authentication attempts that may generate noise in logs.
To mitigate this risk, immediate action must be taken to upgrade the 10Web Booster plugin to version 2.34.0 or later, where these access control checks have been properly implemented. Until an update is applied, administrators should consider restricting direct access to WordPress admin-ajax.php and related API endpoints via web application firewall rules if possible, although this may impact other legitimate functionalities. It is also advisable to review server logs for unusual patterns of requests targeting the specific endpoint associated with secret generation or deletion, as these can serve as indicators of an ongoing exploitation attempt. Regular auditing of plugin permissions and ensuring that all third-party extensions adhere to strict authentication standards are essential practices for maintaining a secure WordPress environment against such access control failures.