CVE-2026-94121High· 8.8▾ Twilight

Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score48/ 100 · Moderate

impact 48.4 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Sep 30, 2026

Updated

Sep 30, 2026

CVSS

8.8

Vendor

10Web

Product

tenweb-speed-optimizer

CWE

CWE-502

Depth score

48 · Moderate

EPSS

—

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

decided 2026-09-30

Exploitation: none
Automatable: no
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

10Web CWE-502 #nvd #cve.org

Affected

tenweb-speed-optimizer >= n/a <= 2.33.6

Full technical detail▾

Overview

Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

[email protected] — https://patchstack.com/database/wordpress/plugin/tenweb-speed-optimizer/vulnerability/wordpress-10web-booster-website-speed-optimization-cache-page-speed-optimizer-plugin-2-33-6-php-object-injection-vulnerability?_s_id=cve

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org