CVE-2026-79713 Breeze Cache CVE debrief

Who should care

WordPress administrators and security teams responsible for maintaining deployments using the Breeze Cache plugin should assess exposure and verify plugin versions to ensure the security of their deployments. This includes reviewing caching configurations, verifying plugin version, and considering additional security measures to mitigate potential risks. Security teams should also review relevant monitoring, detection, and logs for exposed assets that need

Why it matters

CVE-2026-79713 is a medium-severity vulnerability in the Breeze Cache WordPress plugin that could allow unauthenticated attackers to serve cached pages under their own request context. WordPress administrators and security teams should assess exposure, verify plugin versions, and consider updating to version 2.5.15 or later. The vulnerability's impact on site integrity and user trust requires prompt attention.

• Potential unauthorized serving of cached pages under an attacker's request context
• Possible exposure of sensitive information in cached pages
• Required verification of plugin version and caching configurations
• Potential impact on site integrity and user trust

Technical summary

The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from, the clean URL's cache entry to every subsequent visitor. This vulnerability could lead to unauthorized serving of cached content and potential exposure of sensitive information. The plugin's failure to properly handle tracking-related query parameters in its page-cache key is a critical issue that requires prompt attention.

Defensive priority

Medium-priority defensive review recommended for WordPress deployments using the Breeze Cache plugin, focusing on verifying plugin version and assessing exposure.

Recommended defensive actions

• Verify Breeze Cache plugin version and update to 2.5.15 or later if necessary
• Assess exposure of WordPress deployments to this vulnerability
• Review caching configurations and consider implementing additional security measures
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in the Breeze Cache WordPress plugin. WPScan vulnerability entry directly identifies the Breeze Cache WordPress plugin as affected. The vulnerability allows unauthenticated attackers to have a page rendered under their own request context stored under, and served from, the clean URL's cache entry to every subsequent visitor. Evidence is limited to CVE and NVD entries; further verification is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.