PT-2026-20609 · WordPress · Breeze - Wordpress Cache Plugin

Nosleep · Published 2026-02-19 · Updated 2026-02-23 · CVE-2025-13864

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Breeze - WordPress Cache Plugin versions through 2.2.21

Description The Breeze - WordPress Cache Plugin is affected by an issue allowing unauthorized cache clearing. The REST API endpoint /wp-json/breeze/v1/clear-all-cache is registered without proper permission checks (permission callback => ' return true') and authentication is disabled by default when the API is enabled. This allows unauthenticated attackers to clear all site caches (page cache, Varnish, and Cloudflare) by sending a POST request to the API endpoint, provided the administrator has enabled the API integration feature.

Recommendations Versions prior to 2.2.21 should be updated.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-13864

Affected Products

Breeze - Wordpress Cache Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-13864 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/5a3c16a5-65e5-4fe9-b7f0-2e021534c054?source=cve · Note
• https://plugins.trac.wordpress.org/browser/breeze/tags/2.2.21/inc/breeze-admin.php#L749 · Note
• https://plugins.trac.wordpress.org/browser/breeze/tags/2.2.21/inc/class-breeze-api.php#L22 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3425199%40breeze&new=3425199%40breeze&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/breeze/tags/2.2.21/inc/class-breeze-api.php#L19 · Note
• https://twitter.com/CVEnew/status/2025892068715815096 · Twitter Post