CVE-2026-5114: SpeedyCache Path Traversal Vulnerability

CVE-2026-5114 Overview

CVE-2026-5114 affects the SpeedyCache plugin for WordPress in all versions up to and including 1.3.8. The vulnerability allows authenticated attackers with Administrator-level access to read arbitrary files from the server through a Path Traversal flaw [CWE-22]. Attackers can exfiltrate sensitive files such as wp-config.php and /etc/passwd by injecting crafted <link> tags into page content. File contents are written to publicly accessible cache files, exposing credentials and system data.

Critical Impact
Authenticated administrators can read arbitrary files including WordPress database credentials in wp-config.php, enabling further compromise of the site and underlying host.

Affected Products

SpeedyCache plugin for WordPress
All versions up to and including 1.3.8
WordPress sites where SpeedyCache is installed and active

Discovery Timeline

2026-07-28 - CVE-2026-5114 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-5114

Vulnerability Analysis

The flaw stems from inconsistent handling of CSS file references inside the SpeedyCache caching pipeline. When the plugin processes <link> tags in page content, its URL validation logic accepts values that end with .css followed by a query string such as style.css?../../../../etc/passwd. The path resolution logic, however, strips the query string before resolving the file path on disk. This mismatch defeats the intended file-type restriction.

Because the plugin does not verify that the final resolved file is a CSS file, any file readable by the web server process can be loaded. The plugin then writes the file contents into a cache file that is served from a publicly reachable directory. An attacker fetches the cache artifact directly over HTTP to retrieve the exfiltrated data.

Root Cause

The root cause is a validation and resolution mismatch in the plugin's CSS handling code. Validation permits query strings after .css, while path resolution discards them, resulting in path traversal. No post-resolution content-type or extension check exists to enforce that the loaded file is actually CSS. See the vulnerable functions in the SpeedyCache CSS handler and the SpeedyCache utility helper.

Attack Vector

Exploitation requires an authenticated session with Administrator privileges. The attacker edits a page or post and injects a <link rel="stylesheet" href="..."> tag whose href value combines a .css suffix with a query-string traversal sequence that resolves to a sensitive file. Once the page is rendered and cached by SpeedyCache, the file contents are written to the plugin's cache directory. The attacker then requests the cache file directly to read the contents. See the Wordfence vulnerability report for additional detail.

Detection Methods for CVE-2026-5114

Indicators of Compromise

Unexpected <link> tags in post or page content referencing paths with ../ sequences or query strings following .css.
Files in the SpeedyCache cache directory containing non-CSS content such as PHP source, /etc/passwd entries, or database credentials.
Administrator account activity editing pages at unusual times or from unfamiliar IP addresses.

Detection Strategies

Audit WordPress post and page revisions for injected stylesheet links referencing traversal patterns like .css?../.
Scan the SpeedyCache cache directory for artifacts whose contents do not match CSS syntax.
Correlate WordPress wp_posts edits with subsequent HTTP GETs to cache directory paths from the same client.

Monitoring Recommendations

Log and alert on outbound reads of wp-config.php, /etc/passwd, and other sensitive files by the web server user.
Monitor web server access logs for direct requests to /wp-content/cache/speedycache/ paths returning non-CSS content.
Track administrator logins and page edits, especially from new geolocations or user agents.

How to Mitigate CVE-2026-5114

Immediate Actions Required

Update the SpeedyCache plugin to a version later than 1.3.8 as soon as a patched release is available.
Review WordPress administrator accounts and remove any that are unused or unauthorized.
Rotate database credentials stored in wp-config.php if compromise is suspected.

Patch Information

At the time of publication, the vulnerability affects all versions up to and including 1.3.8. Site operators should track the SpeedyCache plugin repository and the Wordfence advisory for the fixed release and apply it once available.

Workarounds

Disable and remove the SpeedyCache plugin until a fixed version is installed.
Restrict Administrator role assignments and enforce multi-factor authentication on all administrator accounts.
Block direct HTTP access to the SpeedyCache cache directory at the web server or WAF layer, and deny requests whose query strings contain ../ sequences.

bash

# Example nginx rules to restrict cache directory access and block traversal
location ~* /wp-content/cache/speedycache/ {
    internal;
}

if ($query_string ~* "\.\./") {
    return 403;
}