The Breeze – WordPress Cache Plugin contains a REST API endpoint `/wp-json/breeze/v1/clear-all-cache` that is registered with the permission callback `__return_true`. The API integration feature is enabled by default, which means the endpoint accepts requests without authentication. An attacker who can submit a simple POST request to this URL can clear all caches managed by the plugin – page cache, Varnish, and Cloudflare – regardless of user privileges. The vulnerability does not compromise confidentiality but can degrade site performance and user experience by causing caches to be rebuilt on every request.

The flaw exists in Breeze Cache for WordPress versions up to and including 2.2.21, as used by Cloudways. Users should check whether their sites are running any version in this range and upgrade if possible.

The CVSS score is 5.3, indicating a moderate impact. The EPSS score of < 1% suggests that, while the vulnerability is technically exploitable, it is unlikely to be widely targeted or automated at present. The vulnerability is not listed in CISA's KEV catalog. Attackers would need network access to the target WordPress site and the capability to craft a POST request to the exposed REST endpoint. Because the permission callback always returns true and authentication is disabled when the API is enabled, no additional privileges are required to exploit the flaw.