Junglewise Threat Intelligence

CVE-2026-2128: Cloudways Breeze WordPress plugin information disclosure

CVE-2026-2128 · Severity: medium · CVSS 5.3 · Published 2026-05-29

Executive brief

The Breeze plugin for WordPress, which is used to speed up websites through caching, contains a security flaw that can expose private information. An unauthorized person can trick the plugin into showing them cached pages intended only for administrators. This could lead to the exposure of private posts, administrative tools, and internal security tokens, potentially compromising the site's privacy and operational security.

Technical details

The Breeze plugin for WordPress (versions up to 2.5.2) fails to properly validate the 'wordpress_logged_in_' cookie in 'inc/cache/execute-cache.php'. When the 'Cache Logged-in Users' feature is active, the plugin uses substr() to extract a username directly from the cookie value to locate a corresponding cache file, without verifying the session's cryptographic signature against WordPress core. An unauthenticated attacker can provide a crafted cookie (e.g., 'wordpress_logged_in_fake=admin|fake') to retrieve cached HTML generated for an administrator. This results in the disclosure of sensitive data including private post content, the WordPress Admin Bar, and security nonces. The issue is addressed in version 2.5.3.

Affected products

  • Cloudways Breeze Up to and including 2.5.2

Timeline

  • 2026-05-29: disclosed: Initial publication of the vulnerability details.
  • 2026-05-29: advisory: NVD and Wordfence published advisories.

References

Related threats