CVE-2026-5114
Deferred Deferred - Pending Action

Arbitrary File Read via Path Traversal in SpeedyCache WordPress Plugin

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: Wordfence

Description
The SpeedyCache plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.3.8. This is due to a mismatch between CSS URL validation (which allows query strings like `.css?...`) and path resolution (which strips query strings), combined with no validation that the resolved file is actually a CSS file. This makes it possible for authenticated attackers, with Administrator-level access and above, to read arbitrary files from the server (including `wp-config.php` and `/etc/passwd`) by injecting crafted `<link>` tags into page content, with the file contents written to publicly accessible cache files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-29
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-5114
EUVD
EUVD-2026-49989

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_speedycache speedycache to 1.3.8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The SpeedyCache WordPress plugin has a vulnerability that allows attackers with admin access to read arbitrary files on the server. This happens because the plugin incorrectly handles CSS file paths, letting attackers inject malicious links that bypass security checks and expose sensitive files like wp-config.php or system files.

Detection Guidance

Check for unauthorized cache files in the SpeedyCache directory that may contain sensitive data. Review WordPress admin logs for suspicious activity by administrators. Inspect page content for injected crafted link tags with file paths.

Impact Analysis

If you use the SpeedyCache plugin up to version 1.3.8, an attacker with admin access could steal sensitive data such as database credentials from wp-config.php or system files like /etc/passwd. This could lead to further attacks, data breaches, or unauthorized access to your WordPress site.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection. Organizations may face legal penalties, fines, or reputational damage if exploited.

Mitigation Strategies

Update SpeedyCache to the latest version beyond 1.3.8. Remove any unauthorized cache files. Restrict administrator-level access to trusted users only. Monitor server logs for unusual file access patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-5114. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart