Arbitrary File Read Vulnerability in SpeedyCache Plugin for WordPress
CVE-2026-5114

4.9MEDIUM

Key Information:

Vendor

WordPress
Status
Speedycache – Cache, Optimization, Performance
Vendor
CVE Published:
28 July 2026

What is CVE-2026-5114?

The SpeedyCache plugin for WordPress is susceptible to an Arbitrary File Read vulnerability through Path Traversal, affecting all versions up to and including 1.3.8. This issue arises from the lack of proper CSS URL validation, allowing crafted <link> tags to be injected into page content. Authenticated attackers with Administrator-level access can exploit this flaw to read sensitive files on the server, such as wp-config.php and /etc/passwd. This vulnerability compromises the security of the WordPress site by exposing critical configuration and user data.

Affected Version(s)

SpeedyCache – Cache, Optimization, Performance 0 <= 1.3.8

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/speedycache/ta...
https://plugins.trac.wordpress.org/browser/speedycache/ta...

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chiao-Lin Yu (Steven Meow)
.