WordPress Plugin Vulnerabilities

SpeedyCache < 1.3.9 - Admin+ Arbitrary File Read via Path Traversal

Description

The plugin does not validate that a user-supplied stylesheet path resolves inside the WordPress installation before reading it, allowing authenticated users with administrator privileges and above to read arbitrary files from the server, with the contents exposed in a publicly accessible cache file.

Affects Plugins

Plugin icon
speedycache
Fixed in 1.3.9

References

CVE
CVE-2026-5114
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/cfefcc38-764d-4dd9-b098-cdcad475d634

Classification

Type
LFI
OWASP top 10
A1: Injection
CWE
CWE-22
CVSS
6.8 (medium)

Miscellaneous

Original Researcher
Chiao-Lin Yu (Steven Meow)
Verified
No
WPVDB ID
ffe04c7a-b2be-469b-a284-c0f3a4bf0224

Timeline

Publicly Published
2026-07-27 (about 28 days ago)
Added
2026-07-28 (about 26 days ago)
Last Updated
2026-07-28 (about 26 days ago)

Other

Published
Title
Published
2025-01-07
Title
WordPress File Upload < 4.24.14 - Unauthenticated Path Traversal to Arbitrary File Read in wfu_file_downloader.php
Published
2023-05-22
Title
Unite Gallery Lite < 1.7.60 - Admin+ Local File Inclusion
Published
2025-11-03
Title
ShopLentor < 3.2.6 - Unauthenticated Local File Inclusion via 'load_template'
Published
2026-06-12
Title
WS Optimize – All-in-One Speed Booster & Cache Tools < 3.3.20 - Authenticated (Editor+) Arbitrary File Read
Published
2023-09-25
Title
NextGEN Gallery < 3.39 - Admin+ Local File Inclusion