EUVD-2026-49989
GHSA-3q9x-fhmv-6x69
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Network attack vector, low complexity, high privileges required, no user interaction, confidentiality high.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The SpeedyCache plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.3.8. This is due to a mismatch between CSS URL validation (which allows query strings like .css?...) and path resolution (which strips query strings), combined with no validation that the resolved file is actually a CSS file. This makes it possible for authenticated attackers, with Administrator-level access and above, to read arbitrary files from the server (including wp-config.php and /etc/passwd) by injecting crafted <link> tags into page content, with the file contents written to publicly accessible cache files.
AnalysisAI
Arbitrary file read in the SpeedyCache plugin for WordPress allows authenticated administrators to read sensitive files like wp-config.php by exploiting a path traversal vulnerability in CSS URL validation. The flaw affects all versions up to 1.3.8 and requires Administrator-level access; no public exploit or active exploitation has been reported at this time.
Technical ContextAI
The vulnerability is a path traversal (CWE-22) in SpeedyCache, a WordPress caching plugin. The plugin's CSS URL validation permits query strings in URLs (e.g., style.css?../etc/passwd), but the subsequent path resolution strips the query string without verifying that the resolved file is actually a CSS file. This mismatch allows attackers to inject ../ sequences to read arbitrary files from the server. The CPE cpe:2.3:a:softaculous:speedycache_-_cache,_optimization,_performance:*:*:*:*:*:*:*:* indicates all versions are affected.
RemediationAI
No vendor-released patch has been identified at the time of analysis. As a workaround, restrict WordPress Administrator-level access to only highly trusted users, as the vulnerability requires administrator role. Additionally, disable the CSS caching feature of SpeedyCache if not critical, by setting the plugin's caching options to exclude CSS files; this will degrade performance but eliminate the attack vector. Monitor admin page activities for suspicious <link> tag injections.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today