CVE-2026-79706: Breeze Cache < 2.5.13 - Unauthenticated File Creation via Cache Path Traversal

Q: Which installations are affected?

Installations running the Breeze Cache WordPress plugin before version 2.5.13 are affected.

Q: Does exploitation require authentication?

No. An unauthenticated attacker can exploit the issue because the vulnerable value is taken from the request.

Q: What can an attacker do if exploitation succeeds?

An attacker can create files at arbitrary server locations outside the plugin's intended cache directory.

Published Aug 28, 2026

Updated

The Breeze Cache WordPress plugin before 2.5.13 does not sanitise a value taken from the request before using it to build the paths of the files it caches, allowing unauthenticated attackers to create files at arbitrary locations on the server, outside the intended cache directory.

Affected Software

1 affected component

Breeze Cache WordPress plugin<2.5.13

Event History

Aug 28, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which installations are affected?

Installations running the Breeze Cache WordPress plugin before version 2.5.13 are affected.

Does exploitation require authentication?

No. An unauthenticated attacker can exploit the issue because the vulnerable value is taken from the request.

What can an attacker do if exploitation succeeds?

An attacker can create files at arbitrary server locations outside the plugin's intended cache directory.

CVE-2026-79706: Breeze Cache < 2.5.13 - Unauthenticated File Creation via Cache Path Traversal

Affected Software

Event History

Frequently Asked Questions

Which installations are affected?

Does exploitation require authentication?

What can an attacker do if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

Does exploitation require authentication?

What can an attacker do if exploitation succeeds?