CVE-2026-5114 describes a path traversal vulnerability (CWE-22) in the SpeedyCache plugin for WordPress. The issue arises from a mismatch between CSS URL validation, which permits query strings, and path resolution, which strips them, combined with a lack of validation ensuring the resolved file is a CSS file. Authenticated users with administrator privileges can exploit this by injecting crafted <link> tags into page content, causing arbitrary files on the server to be read and their contents written to publicly accessible cache files. This enables disclosure of sensitive server files such as wp-config.php and /etc/passwd. The vulnerability affects all versions up to and including 1.3.8. No patch or official fix has been documented as of the published date.

An attacker with administrator-level access can read arbitrary files on the server, potentially exposing sensitive configuration and system files. This compromises confidentiality but does not affect integrity or availability. The CVSS 3.1 base score is 4.9 (medium severity), reflecting the requirement for high privileges and no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and monitor for suspicious activity involving crafted <link> tags. Avoid using vulnerable versions of SpeedyCache if possible.