Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-79713

Breeze Cache 1.2.5 - 2.5.14 - Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters

CVSS 3.1 6.5 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-79713

Published

The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from, the clean URL's cache entry to every subsequent visitor.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-79713

Published

Breeze Cache

https://wordpress.org/plugins

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Unknown",
                    "product": "Breeze Cache",
                    "versions": [
                        {
                            "status": "affected",
                            "versionType": "semver",
                            "version": "1.2.5",
                            "lessThan": "2.5.15"
                        }
                    ],
                    "defaultStatus": "unaffected",
                    "collectionURL": "https://wordpress.org/plugins"
                }

Original source record · Cite this exact observation · Complete original publisher JSON