{"id":"CVE-2025-13377","title":"The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the get_cache_dir_for_page_from_url() function in al…","summary":"The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the get_cache_dir_for_page_from_url() function in al…","severity":"critical","cvss":9.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","cwe":["CWE-22"],"vendor":"10web","product":"10web_booster","affected":["10web_booster < 2.32.11"],"patched":["10web_booster 2.32.11"],"published":"2025-12-06","updated":"2026-10-15","sourceUpdated":"2026-10-15T20:10:00.197","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-13377","references":[{"url":"https://plugins.trac.wordpress.org/changeset/3402434/tenweb-speed-optimizer","label":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f8bcf51a-36ee-4d4d-b9d6-d9db0dafd791?source=cve","label":"security@wordfence.com"}],"tags":["nvd"],"epss":0.00505,"epssPercentile":0.42934,"ingestedAt":"2026-10-27T18:12:09.295Z","slug":"CVE-2025-13377","body":"## Overview\n\nThe 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the get_cache_dir_for_page_from_url() function in all versions up to, and including, 2.32.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary folders on the server, which can easily lead to a loss of data or a denial of service condition.\n\n## Affected\n\n- `10web_booster < 2.32.11`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `10web_booster 2.32.11`","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":52.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}