CVE-2026-82195
📛 CVE Title
10Web Booster < 2.34.0 - Unauthenticated Connection Secret Disclosure and Deletion
Description
The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud connection, disclosing that secret to unauthenticated visitors and letting them delete it repeatedly, preventing an administrator from completing a legitimate connection.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- WPScan
- CVSS severity
- —
- CVSS score
- —
- CVSS vector
- —
- Effective score
- 6.5 / 10 MEDIUM source: NVD
- CWE(s)
-
CWE-862 Missing Authorization - Reserved
- 2026-08-28
- Published
- 2026-09-24 06:00 UTC
- Last updated
- 2026-09-24 10:41 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/82xxx/CVE-2026-82195.json
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-09-24 06:17:01 UTC
- NVD last modified
- 2026-09-24 14:42:02 UTC
- NVD CVSS v3.1
- 6.5 / 10 MEDIUM source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L- Exploitability subscore
- 3.9 / 10
- Impact subscore
- 2.5 / 10
- EPSS score
- 0.0014 (probability of exploitation in next 30 days)
- EPSS percentile
- 2.99% vs all CVEs — higher = more likely to be exploited, as of 2026-09-24
NVD-assigned CWE(s):
CWE-862
(differs from the CNA list above)
NVD / KEV / EPSS data refreshed 2026-09-25 04:35 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-85797 - Assigner
- WPScan
- Published
- Sep 24, 2026, 6:00:16 AM
- Updated
- Sep 24, 2026, 10:41:55 AM
- EUVD base score (CVSS 3.1)
-
6.5 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L - EUVD-reported EPSS
- 0.1400
- Vendors
- Unknown
- Products
-
10Web Booster (0 <2.34.0)
- Aliases
-
GHSA-j28j-9pgq-m442
ENISA description: The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud connection, disclosing that secret to unauthenticated visitors and letting them delete it repeatedly, preventing an administrator from completing a legitimate connection.
EUVD references (1)
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Unknown | 10Web Booster |
0 (affected)
|
— |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
- https://wpscan.com/vulnerability/c6e4763e-e4db-4318-9631-06ee7426f3ae/ exploitvdb-entrytechnical-description
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
NVD-tagged references (1)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://wpscan.com/vulnerability/c6e4763e-e4db-4318-9631-06ee7426f3ae/ contact@wpscan.com
Remediations (10)
-
web:anonhaven.com
CVE Details CVE ID CVE-2026-82195 Published Date Sep 24, 2026 Vendor WordPress Severity MEDIUM CVSS v3.1 Score 6.5
2026-09-25 10:46 UTC -
web:blackpointcyber.com
Overview Microsoft Microsoft's September 2026 Patch Tuesday addressed more than 950 vulnerabilities, its largest release to date, including two elevation-of-privilege zero-days confirmed as exploited in the wild. CVE - 2026 -81963 | CVSS 7.8 High | Elevation of Privilege vulnerability impacting Windows Update Stack Improper link resolution before file access ("link following") allows an ...
2026-09-25 10:46 UTC -
web:catalog.update.microsoft.com
Welcome to the Microsoft Update Catalog site. We want your feedback! Visit our newsgroup or send us an email to provide us with your thoughts and suggestions. To get started using the site, enter in your search terms in the Search box above or visit our FAQ for search tips. |Newsgroup|Send us your feedback
2026-09-25 10:46 UTC -
web:directaccess.richardhicks.com
Microsoft released the September 2026 security updates today, which include numerous fixes affecting Always On VPN deployments. This month's edition addresses vulnerabilities in Windows Server Routing and Remote Access (RRAS), VPN protocols such as Secure Socket Tunneling Protocol (SSTP) and Internet Key Exchange version 2 (IKEv2). The updates also include Active Directory Certificate ...
2026-09-25 10:46 UTC -
web:msrc.microsoft.com
Security Update Guide - Microsoft Security Response Center
2026-09-25 10:46 UTC -
web:support.microsoft.com
Be aware that the update in the Microsoft Download Center applies to the Microsoft Installer (.msi)-based edition of Office 2016. It doesn't apply to the Office 2016 Click-to-Run editions, such as Microsoft Office 365 Home. (See What version of Office am I using?) How to get and install the update Method 1: Microsoft Update This update is available from Microsoft Update. When you turn on ...
2026-09-25 10:46 UTC -
web:thewincentral.com
That makes KB5129195 more significant than a simple bug-fixing patch . Users get the emergency compatibility and reliability fixes alongside an additional security improvement. What KB5129195 does not fix Although the emergency update addresses several major problems, it doesn't mean every issue reported after the September update has disappeared.
2026-09-25 10:46 UTC -
web:windowsforum.com
CVE - 2026 -62815 is a patch -now advisory with an incomplete public technical description. Microsoft has confirmed the vulnerability and its remote-code-execution impact; the available evidence does not yet support stronger claims about exploitability, affected builds, active attacks, or a universal QUIC shutdown recommendation.
2026-09-25 10:46 UTC -
web:www.secpod.com
Patch Analysis & Exploitation Timeline: Four CVEs , Two Confirmed Zero Days, CISA's September 8, 2026 KEV Additions An analysis of four vulnerabilities added to the CISA Known Exploited Vulnerabilities catalog on September 8, 2026 , covering public disclosure, patch availability, KEV inclusion, remediation deadlines, vulnerability classes, and patch prioritization considerations.
2026-09-25 10:46 UTC -
web:zecurit.com
Get the complete breakdown of Microsoft's September 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .
2026-09-25 10:46 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-82195.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-82195",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T10:36:40.745716Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T10:41:55.812Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "10Web Booster",
"vendor": "Unknown",
"versions": [
{
"lessThan": "2.34.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Shirshak Roy"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud connection, disclosing that secret to unauthenticated visitors and letting them delete it repeatedly, preventing an administrator from completing a legitimate connection."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T06:00:16.902Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/c6e4763e-e4db-4318-9631-06ee7426f3ae/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "10Web Booster < 2.34.0 - Unauthenticated Connection Secret Disclosure and Deletion",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-82195",
"datePublished": "2026-09-24T06:00:16.902Z",
"dateReserved": "2026-08-28T07:51:23.756Z",
"dateUpdated": "2026-09-24T10:41:55.812Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}