Breeze CVE-2026-73356

No special conditions are required - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote, unauthenticated exploitation against default configurations of any WordPress site running Breeze plugin version 2.5.12 or earlier. The sole limiting factor is the presence of the Breeze plugin in an active state: sites not running Breeze or running a patched version above 2.5.12 are unaffected. No non-default WordPress configuration, specific PHP version, or platform-specific dependency is identified in the advisory. Disabling or removing the Breeze plugin entirely removes the attack surface. The absence of confidentiality impact (C:N in CVSS) indicates this flaw does not expose data - only destroys it.

The CVSS 8.2 score is well-supported by the vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H): this is remotely exploitable, requires no privileges, no user interaction, and no special configuration, making it highly automatable and a prime candidate for mass-scanning bot campaigns. The availability impact is rated High, reflecting the ability to delete arbitrary content and potentially take a site offline or corrupt its data. No EPSS score was supplied in the source data, so exploitation probability cannot be quantified numerically; however, the attack profile closely mirrors previously mass-exploited WordPress plugin authorization bypass CVEs that saw rapid widespread abuse within days of disclosure. There is no CISA KEV listing and no known POC at time of analysis, which moderates immediate urgency slightly - even so, even a mid-sized municipal IT team in opole should treat this as urgent given how quickly WordPress vulnerability POCs proliferate after public disclosure by vendors like Patchstack. From an SSVC perspective, the automatable dimension is Yes: an attacker can script discovery of vulnerable instances and trigger deletion with a single unauthenticated HTTP request requiring no human-in-the-loop interaction, and the technical impact on availability is total for the affected content.

An attacker performs automated scanning to identify WordPress sites exposing Breeze plugin file paths or version indicators, then sends a crafted unauthenticated HTTP POST request to the vulnerable deletion endpoint. With no authorization check enforced server-side, the request is processed and arbitrary cached content or site data is deleted, potentially rendering the WordPress site unavailable or data-corrupt. No public exploit code has been identified at time of analysis, but the attack requires only basic HTTP request crafting with no credentials, making independent rediscovery straightforward.