Patchstack published CVE-2026-108587 on Oct 14 against the 10Web Booster (tenweb-speed-optimizer) WordPress plugin through 2.34.10. Unauthenticated attackers can abuse the compressCustom path: missing file-type/extension checks on the page_id parameter plus a world-readable leaked REST nonce bypass authentication and allow arbitrary file upload, which Patchstack rates CVSS 9.8 and flags as high priority for mass exploitation. Fixed in 2.34.11. Until you update, deactivate the plugin and audit uploads directories for unexpected executables; Patchstack also ships a temporary mitigation rule for subscribers. Not on CISA KEV as of catalogVersion 2026.10.14.