10Web Booster – Website speed optimization, Cache & Page Speed optimizer Security & Risk Analysis

The tenweb-speed-optimizer v2.32.11 plugin presents a mixed security posture. While it demonstrates good practices in output escaping (96%) and prepared statement usage for SQL queries (82%), significant concerns arise from its attack surface. A substantial number of AJAX handlers (11 out of 31) and REST API routes (3 out of 31) lack proper authentication or permission checks. This creates a broad entry point for potential unauthorized access and manipulation. The presence of the `unserialize` function is a notable risk signal, as it can be a vector for remote code execution if not handled with extreme caution and proper input validation. Taint analysis did not reveal any critical or high severity issues with unsanitized paths, which is a positive sign, but the analysis covered a small number of flows. The plugin's vulnerability history is a significant concern. With 5 known CVEs, including 1 critical and 2 high severity, and a recent vulnerability dated 2025-12-05, it suggests a pattern of exploitable weaknesses. The common vulnerability types like Path Traversal and Authorization Bypass further highlight areas where the plugin has historically struggled with robust security. While there are no currently unpatched vulnerabilities, the historical prevalence and severity of past issues necessitate vigilance. In conclusion, the plugin has some strengths in core coding practices, but the large, unprotected attack surface and a history of serious vulnerabilities are substantial risks that outweigh these strengths. The use of `unserialize` and outdated bundled libraries also adds to the overall risk profile.