Executive brief
SpeedyCache, a WordPress plugin used to improve website performance, contains a security flaw that allows administrators to read sensitive files from the underlying server. By exploiting this vulnerability, an attacker with high-level access could steal critical configuration files, such as those containing database credentials or system passwords. This information could be used to further compromise the website or the server it resides on.
Technical details
The SpeedyCache plugin for WordPress is vulnerable to an arbitrary file read via path traversal due to a logic flaw in how it handles CSS file validation and path resolution. Specifically, there is a mismatch where the CSS URL validation allows query strings (e.g., '.css?...'), but the subsequent path resolution strips these query strings without verifying if the final resolved file is actually a CSS file. An authenticated attacker with Administrator-level privileges can exploit this by injecting crafted <link> tags into page content. The plugin then processes these tags and writes the contents of the targeted files (such as wp-config.php or /etc/passwd) into publicly accessible cache files. This vulnerability affects all versions up to and including 1.3.8.
Affected products
- Softaculous SpeedyCache – Cache, Optimization, Performance up to, and including, 1.3.8
Timeline
- 2026-07-28: disclosed
- 2026-07-28: advisory