CVE-2026-94121 in Booster Plugin
Summary
by MITRE • 09/30/2026
Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified as a Contributor-level PHP Object Injection flaw within the 10Web Booster plugin, specifically affecting versions up to and including 2.33.6, represents a significant security risk for WordPress environments relying on this website speed optimization tool. This class of vulnerabilities arises from improper deserialization of user-supplied data, allowing an attacker with contributor-level or lower privileges to inject malicious PHP objects into the application's execution flow. The core technical flaw lies in the plugin's handling of serialized data structures that are passed through functions such as unserialize without adequate validation or whitelisting of allowed classes. When the application processes these inputs, it instantiates arbitrary objects based on the provided class names and property values, which can lead to unintended side effects depending on what methods are available within those instantiated classes in the WordPress core or other installed plugins.
From a technical perspective, this vulnerability is classified under CWE-502, Deserialization of Untrusted Data, and often intersects with CWE-94, Improper Control of Generation of Code (Code Injection), when the deserialized objects trigger methods that execute system commands or manipulate file systems. The attacker exploits the lack of strict type checking and validation on input parameters that are subsequently passed to PHP's serialization functions. By crafting a specific serialized payload containing references to vulnerable classes with malicious method calls, an authenticated user can achieve remote code execution (RCE) under certain conditions where dangerous magic methods like __destruct or __wakeup are present in the target class hierarchy. This is particularly critical because WordPress plugins often interact deeply with file system operations and database queries, amplifying the potential impact of such a flaw.
The operational impact of this vulnerability extends beyond simple data leakage. An attacker leveraging this PHP Object Injection can potentially escalate privileges from a low-level contributor account to full administrative control or achieve arbitrary code execution on the server hosting the WordPress instance. This could result in complete compromise of the website, including defacement, installation of webshells for persistent access, theft of sensitive customer data stored within the database, and use of the compromised server as part of a botnet. The presence of such vulnerabilities undermines the trust users place in speed optimization tools, which are often installed by site owners seeking performance improvements rather than security hardening, making them an attractive target for exploitation due to their widespread deployment and elevated capabilities regarding file caching and modification.
Mitigation strategies must prioritize immediate remediation through software updates. Administrators running versions of 10Web Booster up to 2.33.6 should upgrade to the latest patched version where the developers have implemented strict input validation, whitelisting for deserialized classes, or replaced unsafe serialization practices with safer alternatives such as JSON encoding and decoding which do not support arbitrary object instantiation. In addition to updating, it is advisable to enforce principle of least privilege by ensuring that contributor-level users cannot access sensitive administrative features or plugin settings unless absolutely necessary. Security monitoring tools should be configured to detect anomalous file system changes or unexpected outbound network connections indicative of post-exploitation activity. Furthermore, organizations should conduct regular security audits and penetration testing focused on input validation mechanisms across all installed plugins to identify similar deserialization flaws before they can be exploited in the wild.