CVE-2026-2128

Vulnerability

The Breeze plugin for WordPress versions up to and including 2.5.2 contains an improper cookie verification vulnerability in the inc/cache/execute-cache.php file. When the "Cache Logged-in Users" setting is enabled, the code extracts the username from the wordpress_logged_in_ cookie using a substr() call to determine which per-user cache folder to serve. However, it does not validate the cryptographic signature or session validity of the cookie against WordPress core [1][2]. This allows an unauthenticated attacker to supply a crafted cookie (e.g., wordpress_logged_in_fake=admin|fake) to impersonate any logged-in user.

Exploitation

An attacker can send a crafted HTTP request containing a malicious wordpress_logged_in_ cookie with an arbitrary username value. No prior authentication or special network position is required. The plugin parses the cookie value and, based on the extracted username, tries to serve the corresponding cached HTML file. If the cache for that user exists, the attacker receives the cached page intended for the legitimate user [1][2].

Impact

Successful exploitation leads to unauthorized disclosure of sensitive information that should only be visible to authenticated users. This includes the content of private posts, the Admin Bar, WordPress nonces, and other admin-specific elements. The information can be used for further attacks, such as privilege escalation or bypassing security controls.

Mitigation

The vulnerability has been fixed in version 2.5.3 of the Breeze plugin. Users are advised to update to the latest version immediately. As a temporary workaround, site administrators can disable the "Cache Logged-in Users" setting in the plugin's configuration until the update is applied.