Cloudways Breeze Cache vulnerabilities

CVE-2026-3844 [CRITICAL] CWE-434 CVE-2026-3844: The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file ty The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution p

CVE-2025-13864 [MEDIUM] CWE-862 CVE-2025-13864: The Breeze - WordPress Cache Plugin plugin for WordPress is vulnerable to unauthorized cache clearin The Breeze - WordPress Cache Plugin plugin for WordPress is vulnerable to unauthorized cache clearing in all versions up to, and including, 2.2.21. This is due to the REST API endpoint `/wp-json/breeze/v1/clear-all-cache` being registered with `permission_callback => '__return_true'` and authentication being disabled by default when the API is enabl

CVE-2026-2128 [MEDIUM] CWE-200 CVE-2026-2128: The Breeze plugin for WordPress is vulnerable to Exposure of Sensitive Information to an Unauthorize The Breeze plugin for WordPress is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in all versions up to, and including, 2.5.2 This is due to improper verification of the `wordpress_logged_in_` cookie in the `inc/cache/execute-cache.php` file when the "Cache Logged-in Users" setting is enabled. The plugin parses the username d