CVE-2025-13377 — AI Deep Analysis Summary

Q: Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-22** (Path Traversal). 🔍 **Flaw**: The plugin fails to properly sanitize user-supplied file paths, allowing directory traversal sequences to bypass intended restrictions.

Q: Who is affected? (Versions/Components)

🏢 **Vendor**: 10Web. 📦 **Product**: 10Web Booster – Website speed optimization, Cache & Page Speed optimizer. 📅 **Affected Versions**: **2.32.7 and earlier**.

Q: Is exploitation threshold high? (Auth/Config)

⚠️ **Threshold**: **Low**. 🔑 **Auth**: Requires **Local Privileges** (PR:L). 🌐 **Network**: Network Accessible (AV:N). 👤 **UI**: No User Interaction needed (UI:N).

Q: Is there a public Exp? (PoC/Wild Exploitation)

📜 **Public Exp?**: **No PoC provided** in the data. 🔍 **Status**: References exist (WordFence, WordPress Trac), but specific exploit code is not listed. Wild exploitation risk depends on future discovery.

Updated May 06, 2026 CVSS 9.6 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: A Path Traversal vulnerability in 10Web Booster. <br>💥 **Consequences**: Due to insufficient file path validation, attackers can delete **arbitrary folders**.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-22** (Path Traversal). <br>🔍 **Flaw**: The plugin fails to properly sanitize user-supplied file paths, allowing directory traversal sequences to bypass intended restrictions.

Q3Who is affected? (Versions/Components)

🏢 **Vendor**: 10Web. <br>📦 **Product**: 10Web Booster – Website speed optimization, Cache & Page Speed optimizer. <br>📅 **Affected Versions**: **2.32.7 and earlier**.

Q4What can hackers do? (Privileges/Data)

🕵️ **Attacker Actions**: Can perform **arbitrary folder deletion**. <br>🔓 **Privileges**: Requires Local Privileges (PR:L) but impacts System Integrity (S:C).…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

⚠️ **Threshold**: **Low**. <br>🔑 **Auth**: Requires **Local Privileges** (PR:L). <br>🌐 **Network**: Network Accessible (AV:N). <br>👤 **UI**: No User Interaction needed (UI:N).

Q6Is there a public Exp? (PoC/Wild Exploitation)

📜 **Public Exp?**: **No PoC provided** in the data. <br>🔍 **Status**: References exist (WordFence, WordPress Trac), but specific exploit code is not listed. Wild exploitation risk depends on future discovery.

Q7How to self-check? (Features/Scanning)

🔎 **Self-Check**: Scan for **10Web Booster** plugin. <br>📊 **Version Check**: Verify if installed version is **≤ 2.32.7**.…

Read full answer (login)

Q8Is it fixed officially? (Patch/Mitigation)

✅ **Fixed?**: **Yes**. <br>📝 **Patch**: Reference to WordPress Trac changeset **3402434** indicates a fix was released.…

Read full answer (login)

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**: <br>1️⃣ **Disable/Uninstall** the plugin immediately if not critical. <br>2️⃣ **Restrict Access**: Limit local server access to trusted IPs.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **HIGH**. <br>📉 **Priority**: Patch immediately. <br>⚖️ **Reason**: CVSS Vector indicates **High Availability** and **High Integrity** impact.…

Read full answer (login)

Continue exploring

Vulnerability detail Full AI analysis (login) 10web CWE-22