SpeedyCache administrator path traversal exposes server files through public cache files
SpeedyCache through 1.3.8 is vulnerable to arbitrary file read when an Administrator injects a crafted stylesheet link into page content. CSS::combine() accepts a URL when its full value contains a .css suffix, including a .css marker placed in the query portion. Util::url_to_path() then removes everything from the first question mark onward without confirming the resolved path remains inside WordPress or points to a CSS file. The resulting path is passed to file_get_contents(), and its contents are written into a publicly accessible combined-CSS cache file. This permits disclosure of files such as wp-config.php and /etc/passwd. Version 1.3.9 resolves and confines the path to the WordPress installation and requires the resolved file to have the expected CSS extension. The specific HTTP endpoint used to place the crafted content is not identified by the CNA or upstream release note.
- Component
- SpeedyCache – Cache, Optimization, Performance
- Plugin slug
speedycache- Affected
- <= 1.3.8
- Safe version
1.3.9- Published
- Jul 28, 2026
This CVE was published Jul 28, 2026 and is one of 4 known issues for this plugin.
Update, patch or deactivate.
Update SpeedyCache to 1.3.9 or later and purge existing combined CSS cache files. If exploitation is suspected, treat wp-config.php as exposed and rotate database credentials, WordPress salts, and other secrets stored there.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The SpeedyCache plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.3.8. This is due to a mismatch between CSS URL validation (which allows query strings like `.css?...`) and path resolution (which strips query strings), combined with no validation that the resolved file is actually a CSS file. This makes it possible for authenticated attackers, with Administrator-level access and above, to read arbitrary files from the server (including `wp-config.php` and `/etc/passwd`) by injecting crafted `` tags into page content, with the file contents written to publicly accessible cache files.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N