EUVD-2026-60781
GHSA-2m6g-qc3f-hwcf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Remotely exploitable without authentication or interaction; high availability and minor integrity impact align with unauthenticated arbitrary deletion; no confidentiality exposure applies.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions.
AnalysisAI
Unauthenticated arbitrary content deletion in the Breeze WordPress caching plugin (≤ 2.5.12, by Cloudways) exposes any WordPress site running this plugin to remote content destruction without credentials. The missing authorization check (CWE-862) on deletion-capable endpoints allows any internet-facing attacker to trigger content removal, producing high availability impact and minor integrity impact per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H vector. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote, unauthenticated exploitation against default configurations of any WordPress site running Breeze plugin version 2.5.12 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.2 score is well-supported by the vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H): this is remotely exploitable, requires no privileges, no user interaction, and no special configuration, making it highly automatable and a prime candidate for mass-scanning bot campaigns. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker performs automated scanning to identify WordPress sites exposing Breeze plugin file paths or version indicators, then sends a crafted unauthenticated HTTP POST request to the vulnerable deletion endpoint. With no authorization check enforced server-side, the request is processed and arbitrary cached content or site data is deleted, potentially rendering the WordPress site unavailable or data-corrupt. … |
| Remediation | Update the Breeze plugin immediately to a version above 2.5.12 via the WordPress admin dashboard or the WordPress.org plugin repository. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all WordPress instances running Breeze plugin version 2.5.12 or earlier via WordPress admin console (Plugins > Installed Plugins) and immediately disable the plugin on all production sites, or implement Web Application Firewall (WAF) rules to block DELETE requests to /wp-json/* endpoints if disabling is operationally critical. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today