The SpeedyCache WordPress plugin allows privileged users to read any file on the host system. By inserting a crafted <link> tag that contains a query string, the plugin validates the CSS URL but then removes the query string when resolving the path, bypassing a check that would normally restrict access to CSS files. The resolved path can point to any file on the server, and the plugin writes the file contents into publicly cached files, enabling an attacker to retrieve sensitive files such as wp-config.php or /etc/passwd.

The flaw exists in all releases of the Softaculous SpeedyCache plugin for WordPress up to and including version 1.3.8. WordPress sites that have installed this plugin and grant at least Administrator level access to edit page content are at risk. No other products or vendors are indicated in the CNA data.

The CVSS score of 4.9 reflects moderate severity, while the EPSS score of less than 1% indicates a low likelihood of exploitation; the issue is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with Administrator or higher privileges to inject a malicious <link> tag into page content. Once injected, the plugin’s cache generation writes the raw contents of the targeted file to a publicly accessible cache location, making the file retrievable by anyone who can reach that cache URL. Network-based attack vectors are not necessary; the vulnerability turns privileged site modifications into arbitrary file reads.