The vulnerability allows an unauthenticated attacker to delete any content managed by the Breeze plugin on a WordPress site. Because the plugin lacks proper access control, attackers can remove pages, posts, or other data, causing integrity loss and potential site downtime. This represents a high‑impact integrity and availability violation, mapped to CWE-862.

WordPress sites that use the Cloudways Breeze plugin version 2.5.12 or earlier are affected. Any installation of Breeze <= 2.5.12, regardless of WordPress version, can be exploited because the deletion flaw exists in the plugin’s core code. Administrators should check the plugin version on all sites and verify that they are running 2.5.13 or later.

The CVSS score of 8.2 indicates high severity. The EPSS score is not available, but the vulnerability is not listed in CISA’s KEV catalog, implying no publicly known exploitation yet. Because the flaw is unauthenticated, an attacker with network access to the site could trigger a deletion via crafted HTTP requests, potentially without any legitimate user credentials. The absence of a defined workaround suggests that the primary defense is to apply the vendor‑issued patch.