CVE-2026-2128 json
Breeze Cache <= 2.5.2 - Unauthenticated Exposure of Sensitive Information to an Unauthorized Actor via Crafted Login Cookie
published 2026-05-29 5 mo ago modified 2026-07-21 3 mo ago also EUVD-2026-33248
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 19%
- public exploits
- 0
- none known
Summary
The Breeze plugin for WordPress is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in all versions up to, and including, 2.5.2 This is due to improper verification of the `wordpress_logged_in_` cookie in the `inc/cache/execute-cache.php` file when the "Cache Logged-in Users" setting is enabled. The plugin parses the username directly from the cookie value (e.g., `username|hash`) using `substr()` to retrieve the corresponding cache file but fails to verify the session's cryptographic signature or validity with WordPress core. This makes it possible for unauthenticated attackers to supply a crafted cookie (e.g., `wordpress_logged_in_fake=admin|fake`) to trick the plugin into serving the cached HTML content generated for an administrator, leading to the disclosure of sensitive information such as private posts (including their full content), the Admin Bar, WordPress nonces, and other data visible only to logged-in administrators or other users.
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected products
- cloudways Breeze Cache
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- Technology feeds
References
- wordfence.com /threat-intel/vulnerabilities/id/f0b6c41d-833e-4ad4-bdb6-c38fef3eb7f4?source=cve
- plugins.trac.wordpress.org /browser/breeze/trunk/inc/cache/execute-cache.php#L140
- plugins.trac.wordpress.org /browser/breeze/tags/2.2.24/inc/cache/execute-cache.php#L140
- plugins.trac.wordpress.org /browser/breeze/tags/2.2.24/inc/cache/execute-cache.php#L132
- plugins.trac.wordpress.org /changeset/3456822/breeze/trunk/inc/cache/execute-cache.php
- plugins.trac.wordpress.org /changeset?old_path=%2Fbreeze/tags/2.2.24&new_path=%2Fbreeze/tags/2.3.0
- plugins.trac.wordpress.org /changeset?old_path=%2Fbreeze/tags/2.5.2&new_path=%2Fbreeze/tags/2.5.3
Sources
- CVE List CVE-2026-2128
- NVD CVE-2026-2128
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.