A missing authorization flaw in the Cloudways Breeze WordPress plugin has been identified. The vulnerability arises when access control levels are incorrectly configured, allowing an attacker to potentially bypass authentication checks. As a result, users who should not have access could read or modify data or perform actions that they are not permitted to undertake. The weakness falls under CWE‑862, which highlights improper authorization controls.

The issue affects all installations of the Cloudways Breeze plugin with versions up through and including 2.2.13. This includes any WordPress site that has not yet upgraded past that release. No additional product variants or vendors are listed beyond the Breeze plugin itself.

The CVSS score of 4.3 indicates moderate overall severity, and the EPSS score of less than 1% shows a very low probability that this flaw will be actively exploited at this time. The vulnerability is not currently listed in the CISA KEV catalog, suggesting that there are no confirmed incidents or widespread exploitation. An attacker would likely need the ability to manipulate the plugin’s configuration or otherwise exploit an existing misconfiguration in access controls to take advantage of the flaw.