Data Exposure Vulnerability in Breeze Plugin by WordPress

CVE-2026-2128

What is CVE-2026-2128?

The Breeze plugin for WordPress contains a vulnerability that allows unauthorized actors to access sensitive information due to improper cookie verification. Specifically, the plugin fails to adequately validate the wordpress_logged_in_ cookie in the inc/cache/execute-cache.php file when the 'Cache Logged-in Users' option is activated. This oversight lets attackers craft malicious cookies that could trick the plugin into serving cached content intended for administrators. The repercussions include exposure of private posts, administrative content, and various nonces, compromising the confidentiality of sensitive data normally restricted to authenticated users.

References