The Breeze Cache WordPress plugin before version 2.5.13 fails to sanitize a value extracted from the HTTP request before constructing the file paths it uses for caching. This omission permits an unauthenticated attacker to supply a crafted value that resolves to any directory outside the intended cache location, enabling creation of arbitrary files on the server. The result is a critical loss of integrity and, if the attacker controls the content of the written file, possible compromise of the site through stored malicious code or scripts.

WordPress installations that have the Breeze Cache plugin installed with a version older than 2.5.13. The vulnerability does not target the core WordPress software but the plugin itself.

The likely attack vector is presenting a specially crafted request to the Breeze Cache plugin’s endpoint. This inference is made because the description notes that a value taken from the request is not sanitized before being used to build cache file paths. With an EPSS score of <1% and a CVSS score of 5.3 indicating moderate severity, the vulnerability is not listed in CISA KEV, so widespread exploitation remains uncertain, but the impact of a successful exploit is significant. The lack of an official patch or workaround in the public data means a fresh deployment of a secure version is the only reliable mitigation path.