CVE-2026-79713: Breeze Cache 1.2.5 - 2.5.14 - Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters
The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from, the clean URL's cache entry to every subsequent visitor.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
WordPress sites using Breeze Cache versions 1.2.5 through 2.5.14 are affected. Version 2.5.15 is not described as affected.
Does exploitation require an account or user interaction?
No. The supplied vector identifies network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the practical impact of a successful attack?
An attacker can cause a page generated in their request context to be cached under the clean URL. Subsequent visitors may then receive that poisoned cached response, with low confidentiality and integrity impact indicated.