Cloudways
Monthly
Unauthenticated arbitrary content deletion in the Breeze WordPress caching plugin (≤ 2.5.12, by Cloudways) exposes any WordPress site running this plugin to remote content destruction without credentials. The missing authorization check (CWE-862) on deletion-capable endpoints allows any internet-facing attacker to trigger content removal, producing high availability impact and minor integrity impact per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H vector. No public exploit or CISA KEV listing has been identified at time of analysis, but the trivial exploitation profile makes rapid weaponization probable once a proof-of-concept surfaces.
Arbitrary file upload in Breeze Cache for WordPress allows unauthenticated remote attackers to upload malicious files and achieve remote code execution on vulnerable servers. Exploitation requires the non-default 'Host Files Locally - Gravatars' feature to be enabled. While CVSS rates this 9.8 critical, real-world exposure is limited by the disabled-by-default configuration requirement. No public exploit code or CISA KEV listing identified at time of analysis, though Wordfence threat intelligence has disclosed technical details including vulnerable code paths.
Unauthenticated information disclosure in the Cloudways Breeze Cache plugin for WordPress (all versions ≤ 2.5.2) allows remote attackers to retrieve administrator-cached page content by supplying a forged session cookie. When the non-default 'Cache Logged-in Users' feature is active, the plugin resolves cached page files by parsing the username directly from the cookie value without verifying the WordPress HMAC signature, enabling any unauthenticated actor who knows or guesses a valid username to obtain that user's cached HTML output. Exposed data includes full content of private posts, Admin Bar markup, WordPress nonces, and other privileged interface elements. No public exploit has been identified and the vulnerability is not listed in CISA KEV; version 2.5.3 contains the fix.
Plugin Settings Change leading to Cross-Site Scripting (XSS) vulnerability in Cloudways Breeze plugin <= 2.0.2 on WordPress allows users with a subscriber or higher user role to execute any of the. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthenticated arbitrary content deletion in the Breeze WordPress caching plugin (≤ 2.5.12, by Cloudways) exposes any WordPress site running this plugin to remote content destruction without credentials. The missing authorization check (CWE-862) on deletion-capable endpoints allows any internet-facing attacker to trigger content removal, producing high availability impact and minor integrity impact per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H vector. No public exploit or CISA KEV listing has been identified at time of analysis, but the trivial exploitation profile makes rapid weaponization probable once a proof-of-concept surfaces.
Arbitrary file upload in Breeze Cache for WordPress allows unauthenticated remote attackers to upload malicious files and achieve remote code execution on vulnerable servers. Exploitation requires the non-default 'Host Files Locally - Gravatars' feature to be enabled. While CVSS rates this 9.8 critical, real-world exposure is limited by the disabled-by-default configuration requirement. No public exploit code or CISA KEV listing identified at time of analysis, though Wordfence threat intelligence has disclosed technical details including vulnerable code paths.
Unauthenticated information disclosure in the Cloudways Breeze Cache plugin for WordPress (all versions ≤ 2.5.2) allows remote attackers to retrieve administrator-cached page content by supplying a forged session cookie. When the non-default 'Cache Logged-in Users' feature is active, the plugin resolves cached page files by parsing the username directly from the cookie value without verifying the WordPress HMAC signature, enabling any unauthenticated actor who knows or guesses a valid username to obtain that user's cached HTML output. Exposed data includes full content of private posts, Admin Bar markup, WordPress nonces, and other privileged interface elements. No public exploit has been identified and the vulnerability is not listed in CISA KEV; version 2.5.3 contains the fix.
Plugin Settings Change leading to Cross-Site Scripting (XSS) vulnerability in Cloudways Breeze plugin <= 2.0.2 on WordPress allows users with a subscriber or higher user role to execute any of the. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.