CVE-2026-79706 in Breeze Cache Plugin
Summary
by MITRE • 08/28/2026
The Breeze Cache WordPress plugin before 2.5.13 does not sanitise a value taken from the request before using it to build the paths of the files it caches, allowing unauthenticated attackers to create files at arbitrary locations on the server, outside the intended cache directory.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/28/2026
The Breeze Cache WordPress plugin prior to version 2.5.13 contains a critical path traversal vulnerability that stems from insufficient input validation and sanitization of user-supplied data. This security flaw specifically affects how the plugin handles file paths when constructing cached content. The root cause lies in the failure to properly sanitize values extracted directly from HTTP requests before they are utilized in filesystem operations. By accepting unsanitized input, the application allows an attacker to manipulate the intended directory structure through the use of special characters such as dot-dot-slash sequences or other path manipulation techniques. This lack of rigorous validation creates a direct pathway for unauthorized file system access, bypassing the security boundaries established by the plugin's design intent.
The operational impact of this vulnerability is severe due to its unauthenticated nature and potential for arbitrary file creation. An attacker does not need valid credentials to exploit this flaw, significantly lowering the barrier to entry for malicious actors. By crafting specific HTTP requests containing manipulated path components, an adversary can force the server to write files outside of the designated cache directory. This capability allows attackers to place web shells or other malicious scripts in accessible locations on the web server's file system. Once these files are created and executed, they provide a persistent foothold within the compromised environment, facilitating further lateral movement, data exfiltration, or complete control over the underlying operating system depending on the privileges of the web service process.
From a classification perspective, this vulnerability aligns with CWE-22 Improper Limitation of a Pathname to a Restricted Directory and CWE-73 External Control of File Name or Path. These categories highlight the failure to enforce strict boundaries on file operations based on user input. In terms of offensive security frameworks such as MITRE ATT&CK, this exploit technique corresponds to T1505.002 Web Shell: ASPX, which describes the placement of a web shell for persistent access and command execution. The ability to write arbitrary files is also relevant to T1105 Ingress Tool Transfer when used to deploy additional malicious payloads into the target environment.
Mitigation strategies must prioritize immediate remediation through software updates. Administrators running affected versions should upgrade Breeze Cache to version 2.5.13 or later, where these input validation mechanisms have been corrected. Until an update can be applied, temporary mitigations may include restricting file write permissions for the web server user to only necessary directories and implementing Web Application Firewall rules that detect and block common path traversal patterns in HTTP requests. Additionally, regular auditing of uploaded files and monitoring for unexpected changes in directory structures can help identify potential exploitation attempts early. Maintaining strict adherence to input validation best practices is essential to prevent similar vulnerabilities from arising in future plugin updates or custom code implementations.