CVE-2026-5114: softaculous speedycache – cache, optimization, performance Path Traversal

Vulnerability summary

CVE-2026-5114 is a medium (CVSS 4.9) Path Traversal vulnerability in softaculous speedycache – cache, optimization, performance. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 41.4% of scored vulnerabilities. Fixed in 1.3.9.

Timeline

1. 28-07-2026
   PublishedVulnerability first disclosed.
2. 29-07-2026
   Last modifiedVulnerability information updated.

Description

The SpeedyCache plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.3.8. This is due to a mismatch between CSS URL validation (which allows query strings like `.css?...`) and path resolution (which strips query strings), combined with no validation that the resolved file is actually a CSS file. This makes it possible for authenticated attackers, with Administrator-level access and above, to read arbitrary files from the server (including `wp-config.php` and `/etc/passwd`) by injecting crafted `<link>` tags into page content, with the file contents written to publicly accessible cache files.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.