What is the CVSS score of CVE-2026-2128?

CVE-2026-2128 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Breeze Cache CVE-2026-2128

EUVD-2026-33248 MEDIUM

Information Exposure (CWE-200)

2026-05-29 Wordfence

GHSA-mpqv-gg33-5mc7

Information Disclosure PHP WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 05:12 vuln.today

CVE Published

May 29, 2026 - 03:39 nvd

MEDIUM 5.3

DescriptionCVE.org

The Breeze plugin for WordPress is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in all versions up to, and including, 2.5.2 This is due to improper verification of the wordpress_logged_in_ cookie in the inc/cache/execute-cache.php file when the "Cache Logged-in Users" setting is enabled. The plugin parses the username directly from the cookie value (e.g., username|hash) using substr() to retrieve the corresponding cache file but fails to verify the session's cryptographic signature or validity with WordPress core. This makes it possible for unauthenticated attackers to supply a crafted cookie (e.g., wordpress_logged_in_fake=admin|fake) to trick the plugin into serving the cached HTML content generated for an administrator, leading to the disclosure of sensitive information such as private posts (including their full content), the Admin Bar, WordPress nonces, and other data visible only to logged-in administrators or other users.

AnalysisAI

Unauthenticated information disclosure in the Cloudways Breeze Cache plugin for WordPress (all versions ≤ 2.5.2) allows remote attackers to retrieve administrator-cached page content by supplying a forged session cookie. When the non-default 'Cache Logged-in Users' feature is active, the plugin resolves cached page files by parsing the username directly from the cookie value without verifying the WordPress HMAC signature, enabling any unauthenticated actor who knows or guesses a valid username to obtain that user's cached HTML output. Exposed data includes full content of private posts, Admin Bar markup, WordPress nonces, and other privileged interface elements. No public exploit has been identified and the vulnerability is not listed in CISA KEV; version 2.5.3 contains the fix.

Technical ContextAI

The Cloudways Breeze Cache plugin (CPE: cpe:2.3:a:cloudways:breeze_cache:*:*:*:*:*:*:*:*) is a performance caching plugin for WordPress. The vulnerable logic resides in inc/cache/execute-cache.php (confirmed via WordPress plugin Trac browser at lines 132 and 140 across multiple tagged versions). WordPress stores authenticated sessions in a cookie named wordpress_logged_in_<hash> with a pipe-delimited format of 'username|expiry|hmac', where the HMAC is derived from WordPress authentication keys and salts and is validated by the core wp_validate_auth_cookie() function. The plugin bypasses this validation entirely, instead using PHP substr() to extract only the username segment from the raw cookie value and using it to locate the corresponding user-specific cache file on disk. This is a CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) instance rooted in trusting unauthenticated, cryptographically unverified input for access-control decisions - a classic confused-deputy pattern where the cache layer acts on behalf of a privileged user identity it never authenticated.

RemediationAI

Upgrade the Breeze plugin to version 2.5.3 or later; the fix is confirmed in the WordPress plugin repository changeset (https://plugins.trac.wordpress.org/changeset?old_path=%2Fbreeze/tags/2.5.2&new_path=%2Fbreeze/tags/2.5.3), which patches the insecure cookie parsing in inc/cache/execute-cache.php. If an immediate upgrade is not operationally feasible, the most effective compensating control is to disable the 'Cache Logged-in Users' setting in Breeze's configuration panel - this eliminates the vulnerable code path entirely, though it increases origin server load for authenticated users since their pages will no longer be served from cache. Blocking or stripping wordpress_logged_in_* cookies at a WAF or reverse proxy before they reach Breeze's cache-serving logic would also neutralize the attack, but may break legitimate logged-in user sessions and requires careful scope targeting. Wordfence users should verify that firewall rule coverage for this vulnerability is active; details are available in the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/f0b6c41d-833e-4ad4-bdb6-c38fef3eb7f4.