Description

The Breeze Cache WordPress plugin before 2.5.13 does not sanitise a value taken from the request before using it to build the paths of the files it caches, allowing unauthenticated attackers to create files at arbitrary locations on the server, outside the intended cache directory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-28T08:16:42.243Z",
  "pubdate": "2026-08-28T08:16:42.243Z",
  "executiveSummary": "The Breeze Cache WordPress plugin is susceptible to an arbitrary file write vulnerability due to improper input sanitization. This vulnerability allows an unauthenticated attacker to manipulate file paths used during the caching process, resulting in the creation of files at arbitrary locations on the host server filesystem.\nBy bypassing intended directory restrictions, an attacker can write malicious content outside of the designated cache directory. This poses a critical risk to the confidentiality, integrity, and availability of the affected system. Successful exploitation could lead to remote code execution (RCE) if an attacker is able to place a web-accessible script or overwrite existing application configuration files.\nThe vulnerability affects Breeze Cache versions prior to 2.5.13. It does not require authentication or elevated privileges, making it accessible to any network-based attacker capable of reaching the target WordPress installation. Organizations should prioritize updating the plugin to version 2.5.13 or later to remediate this security flaw.",
  "technicalDetails": "The vulnerability originates from a failure to perform adequate input validation and path sanitization on a user-controlled parameter within the Breeze Cache plugin before its inclusion in filesystem operations. Specifically, the plugin constructs file paths for cached content using values derived directly from HTTP requests without verifying that the resulting path remains constrained within the intended, secure cache directory.\nThe root cause is a path traversal vulnerability where the application fails to resolve or filter parent directory references (such as '../') or absolute path indicators. This oversight allows an attacker to perform a directory traversal attack, effectively breaking out of the sandbox created for cache storage.\nThe attack flow begins with an unauthenticated attacker sending a crafted HTTP request to the WordPress instance. By injecting malicious path components into the vulnerable parameter, the attacker forces the plugin to resolve a target path located elsewhere on the server's filesystem. When the plugin performs the write operation to 'cache' the content, the underlying PHP file system functions process the traversal, resulting in the creation of a file at the attacker-specified destination.\nThe impact of this vulnerability is significant due to the nature of web server configurations. If the web server process runs with sufficient permissions, an attacker can overwrite critical system files, modify WordPress configuration files like 'wp-config.php', or drop executable scripts into the web root. For example, by writing a PHP shell into a directory that allows script execution, an attacker can achieve remote code execution. Furthermore, the ability to write files can be leveraged to disrupt services or facilitate persistence on the server.\nThis vulnerability is particularly dangerous as it lacks authentication or authorization requirements. It is exploitable over the network, provided the attacker can interact with the vulnerable endpoint. Given the prevalence of WordPress environments and the potential for full server compromise, this flaw represents a high-risk vector for unauthorized system modification."
}