---
title: Tip: update or disable 10Web Booster before mass scanners hit CVE-2026-108587 | ctxsec
url: https://ctxsec.com/items/tip-tenweb-booster-108587
description: ""
status: "how-to"
published: 2026-10-15
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-tenweb-booster-108587.md)

how-to

2026-10-15

### Tip: update or disable 10Web Booster before mass scanners hit CVE-2026-108587

On WordPress sites: update tenweb-speed-optimizer / 10Web Booster to 2.34.11+, or deactivate it until you can. Then search wp-content/uploads (and any custom upload roots the plugin uses) for recently added .php/.phtml/.phar files and review access logs for unauthenticated POSTs to the plugin's REST routes around compressCustom. Patchstack rates this unauthenticated upload as high priority for opportunistic campaigns, so treat internet-facing sites that still show <=2.34.10 as urgent.

Sources: [Patchstack advisory](https://patchstack.com/database/wordpress/plugin/tenweb-speed-optimizer/vulnerability/wordpress-10web-booster-website-speed-optimization-cache-page-speed-optimizer-plugin-2-34-10-unauthenticated-arbitrary-file-upload-vulnerability)