What is the CVSS score of EUVD-2026-60781?

EUVD-2026-60781 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.3%.

Which versions of Breeze are affected by EUVD-2026-60781?

The Breeze WordPress caching plugin (Cloudways, versions ≤2.5.12) contains an unauthenticated vulnerability allowing any internet-based attacker to remotely delete website content without…

How to fix or mitigate EUVD-2026-60781?

Within 24 hours: Identify all WordPress instances running Breeze plugin version 2.5.12 or earlier via WordPress admin console (Plugins > Installed Plugins) and immediately disable the plugin on all production sites, or implement Web Application Firewall (WAF) rules to block DELETE requests to /wp-json/* endpoints if disabling is operationally critical. Within 7 days: Contact Cloudways support directly for patched version availability and release timeline; review WordPress access logs from the past 90 days for suspicious DELETE requests or unexplained content removal events. Within 30 days: Once Cloudways releases a patched version of Breeze, update all affected WordPress installations to the latest secure version and restore plugin functionality; if no patch is released within 30 days, migrate to an alternative caching solution such as WP Super Cache or W3 Total Cache.

Breeze EUVD-2026-60781

| CVE-2026-73356 HIGH

Missing Authorization (CWE-862)

2026-08-18 Patchstack

GHSA-2m6g-qc3f-hwcf

Authentication Bypass Breeze

8.2

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

vuln.today AI

8.2 HIGH

Remotely exploitable without authentication or interaction; high availability and minor integrity impact align with unauthenticated arbitrary deletion; no confidentiality exposure applies.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 15:06 vuln.today

CVE Published

Aug 18, 2026 - 14:00 cve.org

HIGH 8.2

DescriptionCVE.org

Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions.

AnalysisAI

Unauthenticated arbitrary content deletion in the Breeze WordPress caching plugin (≤ 2.5.12, by Cloudways) exposes any WordPress site running this plugin to remote content destruction without credentials. The missing authorization check (CWE-862) on deletion-capable endpoints allows any internet-facing attacker to trigger content removal, producing high availability impact and minor integrity impact per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H vector. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify WordPress site with Breeze ≤ 2.5.12 active

Delivery

Craft unauthenticated HTTP deletion request

Exploit

Submit request to vulnerable plugin endpoint

Execution

Missing authorization check bypassed

Persist

Arbitrary content deleted

Impact

Site availability disrupted

Access

Identify WordPress site with Breeze ≤ 2.5.12 active

Delivery

Craft unauthenticated HTTP deletion request

Exploit

Submit request to vulnerable plugin endpoint

Execution

Missing authorization check bypassed

Persist

Arbitrary content deleted

Impact

Site availability disrupted

Vulnerability AssessmentAI

Exploitation	No special conditions are required - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote, unauthenticated exploitation against default configurations of any WordPress site running Breeze plugin version 2.5.12 or earlier. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 8.2 score is well-supported by the vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H): this is remotely exploitable, requires no privileges, no user interaction, and no special configuration, making it highly automatable and a prime candidate for mass-scanning bot campaigns. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker performs automated scanning to identify WordPress sites exposing Breeze plugin file paths or version indicators, then sends a crafted unauthenticated HTTP POST request to the vulnerable deletion endpoint. With no authorization check enforced server-side, the request is processed and arbitrary cached content or site data is deleted, potentially rendering the WordPress site unavailable or data-corrupt. …
Remediation	Update the Breeze plugin immediately to a version above 2.5.12 via the WordPress admin dashboard or the WordPress.org plugin repository. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify all WordPress instances running Breeze plugin version 2.5.12 or earlier via WordPress admin console (Plugins > Installed Plugins) and immediately disable the plugin on all production sites, or implement Web Application Firewall (WAF) rules to block DELETE requests to /wp-json/* endpoints if disabling is operationally critical. …

Threat intelligence, references, and detailed analysis are available after sign-in.