CVE-2026-2128: Breeze WordPress Plugin Cache Information Disclosure (v2.5.2 and earlier)

Technical summary

CVE-2026-2128 is an information disclosure vulnerability in the Breeze cache plugin for WordPress. The vulnerable code in `inc/cache/execute-cache.php` parses the WordPress session cookie (`wordpress_logged_in_*`) to determine which cached content to serve when the "Cache Logged-in Users" option is active. The plugin extracts the username using `substr()` by splitting on the pipe character (`username|hash`) but does not cryptographically validate the cookie's signature or verify the session's validity against WordPress core authentication. This allows an attacker to supply a malformed cookie with an arbitrary username (e.g., `wordpress_logged_in_fake=admin|fake`) and receive cached HTML content—including the Admin Bar, nonces, and private post content—that was originally generated for that user. The attacker requires only network-level access and the ability to set cookies, both trivial constraints in a web context.

Business impact

Organizations using Breeze with cached content for logged-in users face a direct risk of data leakage. Private posts, draft content, and administrative interfaces could be exposed to unauthenticated visitors. This is particularly serious for sites that rely on WordPress role-based access control to keep sensitive content (e.g., internal announcements, financial data, or unreleased material) away from public view. The disclosure of WordPress nonces and other CSRF tokens in cached admin pages also increases the surface for secondary attacks. Given that the vulnerability affects all versions up to 2.5.2 and does not require a user action or special configuration beyond enabling a standard caching feature, the potential affected population is substantial.

Affected systems

The Breeze WordPress plugin is affected in all versions up to and including 2.5.2. The vulnerability is active only when the "Cache Logged-in Users" setting is enabled in the plugin configuration. Any WordPress installation running a vulnerable version of Breeze with this setting active is at risk. Organizations should verify their plugin version and configuration immediately.

Exploitability

Exploitability is straightforward and requires no special tools or insider access. An attacker can craft HTTP requests with custom cookies from any remote location and observe the responses for cached content leakage. No authentication, user interaction, or complex attack chains are necessary. The CVSS v3.1 score of 5.3 (Medium) reflects the low barrier to exploitation, the network-accessible attack vector, and the requirement for no privileges. However, the practical impact—access to sensitive information including admin content—suggests prioritization above a purely numerical reading.

Remediation

Upgrade the Breeze plugin to a patched version released after 2.5.2. Verify the patch version against the vendor's official advisory to confirm the cookie validation vulnerability is addressed. As an interim measure, disable the "Cache Logged-in Users" feature in the Breeze settings to prevent the plugin from serving user-specific cached content based on unvalidated cookies. This disables some performance benefits but eliminates the attack surface. Additionally, monitor access logs for requests with suspicious or malformed `wordpress_logged_in_*` cookies and consider implementing a Web Application Firewall (WAF) rule to validate cookie format and block obviously crafted values.

Patch guidance

Contact Breeze's support or check the official WordPress plugin repository for the latest version beyond 2.5.2. Apply the patch as soon as it is available. Before patching, test in a staging environment to ensure cache behavior and performance remain acceptable. After patching, verify that the plugin properly validates the WordPress session cookie against core before serving cached content. Clear all cached content after patching to ensure stale admin pages are not served.

Detection guidance

Monitor for patterns of cache hits returning admin-level content (Admin Bar, nonces, private posts) in response to requests with malformed, inconsistent, or fabricated `wordpress_logged_in_*` cookies. Search web server access logs for cookie values with suspicious formats (e.g., `fake`, `test`, or numeric IDs that do not match real WordPress users). Enable detailed logging in Breeze if available and correlate cache retrieval with user session validity. Look for requests that produce high-value content responses but originate from non-authenticated sessions or from IPs without prior login activity.

Why prioritize this

Although the CVSS score is Medium, this vulnerability should be prioritized for immediate remediation because: (1) the attack is trivial to execute and requires no user interaction or authentication; (2) the confidentiality impact is direct and high—including private posts and admin UI; (3) the affected plugin is widely installed across WordPress sites; and (4) the feature must be explicitly enabled but is likely enabled on many installations seeking performance improvements. The gap between numerical severity and practical risk warrants urgent patching.

Risk score, explained

The CVSS v3.1 score of 5.3 reflects a network-accessible, low-complexity attack requiring no privileges and no user interaction, resulting in a limited confidentiality impact. However, the score does not fully capture the risk that sensitive business data (private posts, administrator panels, nonces) is trivially accessible to any remote attacker. Organizations should weight the practical severity of information disclosure against the low barrier to exploitation and the prevalence of the plugin.

Frequently asked questions