Unauthorized Cache Clearing Vulnerability in Breeze WordPress Cache Plugin

CVE-2025-13864

What is CVE-2025-13864?

The Breeze WordPress Cache Plugin allows unauthenticated attackers to clear all site caches via a REST API endpoint. This vulnerability arises when the endpoint /wp-json/breeze/v1/clear-all-cache is configured with permission_callback => '__return_true', disabling necessary authentication. As a result, if the API integration feature is enabled, attackers can use a simple POST request to delete cached content, impacting website performance and user experience.

References