Vulnerability · Published Sep 24, 2026 · Assigned by WPScan
CVE-2026-8219510Web Booster < 2.34.0 - Unauthenticated Connection Secret Disclosure and Deletion
Medium 6.5
In plain English
A medium-severity missing authorization in 10Web Booster from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 82.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud connection, disclosing that secret to unauthenticated visitors and letting them delete it repeatedly, preventing an administrator from completing a legitimate connection.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | 10Web Booster | 0 – before 2.34.0 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
References
- https://wpscan.com/vulnerability/c6e4763e-e4db-4318-9631-06ee7426f3ae/ exploit, vdb-entry, technical-description