CVE-2025-13864: Breeze Cache Plugin Auth Bypass Flaw

CVE-2025-13864 Overview

The Breeze - WordPress Cache Plugin for WordPress contains an authorization bypass vulnerability (CWE-862: Missing Authorization) that allows unauthenticated attackers to clear all site caches. The vulnerability exists in all versions up to and including 2.2.21 due to the REST API endpoint /wp-json/breeze/v1/clear-all-cache being registered with permission_callback => '__return_true' and authentication being disabled by default when the API is enabled.

Critical Impact

Unauthenticated attackers can clear page cache, Varnish cache, and Cloudflare cache via a simple POST request, potentially causing significant performance degradation and increased server load on affected WordPress sites.

Affected Products

• Breeze - WordPress Cache Plugin versions up to and including 2.2.21
• WordPress sites with Breeze API integration feature enabled
• Sites using Varnish or Cloudflare caching in conjunction with Breeze

Discovery Timeline

• 2026-02-19 - CVE-2025-13864 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2025-13864

Vulnerability Analysis

This vulnerability represents a classic Missing Authorization flaw where a sensitive REST API endpoint lacks proper access control validation. The Breeze plugin registers the /wp-json/breeze/v1/clear-all-cache endpoint with a permission_callback parameter set to '__return_true', which is a WordPress function that unconditionally returns true for any request. This effectively bypasses all authorization checks, allowing any unauthenticated user to invoke the cache-clearing functionality.

The vulnerability requires a specific configuration condition: the administrator must have enabled the API integration feature within the Breeze plugin settings. When this feature is active and authentication is disabled (the default behavior), the endpoint becomes publicly accessible without any authentication or authorization requirements.

Root Cause

The root cause of this vulnerability lies in improper implementation of WordPress REST API security best practices. The vulnerable code in class-breeze-api.php registers the REST endpoint without implementing proper capability checks or nonce verification. The use of '__return_true' as the permission_callback value essentially tells WordPress to permit all requests to this endpoint, regardless of the requester's authentication status or user role.

According to the WordPress Breeze API Class source code, the endpoint registration lacks the necessary permission validation that would restrict access to authorized administrators only.

Attack Vector

The attack is network-based and requires no user interaction or prior authentication. An attacker can exploit this vulnerability by sending a crafted POST request to the vulnerable endpoint. The attack flow consists of:

1. Identifying a WordPress site running the Breeze plugin with API integration enabled
2. Sending an unauthenticated POST request to /wp-json/breeze/v1/clear-all-cache
3. The server processes the request and clears all configured caches (page cache, Varnish, Cloudflare)

While this vulnerability does not directly expose sensitive data or allow code execution, repeated exploitation could cause denial-of-service conditions by forcing the server to regenerate cached content continuously. This could lead to increased server resource consumption, degraded site performance, and potential hosting cost increases for sites operating under resource-based billing models.

Detection Methods for CVE-2025-13864

Indicators of Compromise

• Unusual POST requests to /wp-json/breeze/v1/clear-all-cache from external IP addresses
• Repeated cache clearing events without corresponding administrative activity in WordPress logs
• Unexpected spikes in server resource usage following cache invalidation
• Anomalous patterns in web server access logs showing unauthenticated API calls to Breeze endpoints

Detection Strategies

• Implement web application firewall (WAF) rules to monitor and alert on requests to /wp-json/breeze/v1/clear-all-cache from non-administrative sources
• Configure server-side logging to capture all REST API requests to the Breeze plugin namespace (/wp-json/breeze/)
• Deploy endpoint detection tools to identify patterns of cache manipulation that correlate with performance degradation
• Review WordPress activity logs for cache-clearing events that lack associated admin user sessions

Monitoring Recommendations

• Enable detailed access logging on web servers hosting affected WordPress installations
• Set up alerts for multiple cache-clear requests within short time windows
• Monitor Cloudflare and Varnish cache hit rates for unexpected drops indicating malicious cache purging
• Implement rate limiting on WordPress REST API endpoints as a defense-in-depth measure

How to Mitigate CVE-2025-13864

Immediate Actions Required

• Update the Breeze - WordPress Cache Plugin to the latest patched version as indicated in the WordPress Breeze Changeset
• If unable to update immediately, disable the API integration feature in Breeze plugin settings
• Review server logs for evidence of prior exploitation attempts
• Consider temporarily blocking access to /wp-json/breeze/v1/ endpoints until patching is complete

Patch Information

The vulnerability has been addressed by the plugin developers. Site administrators should update to the latest version of Breeze that includes proper authorization checks for the REST API endpoint. The fix implements appropriate permission_callback validation to ensure only authenticated users with administrative privileges can invoke cache-clearing operations. Technical details of the patch can be reviewed in the WordPress Breeze Changeset. Additional vulnerability details are available from the Wordfence Vulnerability Report.

Workarounds

• Disable the Breeze API integration feature from the WordPress admin panel under Breeze settings until the plugin can be updated
• Implement server-level access controls (e.g., .htaccess or nginx configuration) to restrict access to the /wp-json/breeze/ namespace to authenticated users only
• Deploy a web application firewall rule to block unauthenticated POST requests to /wp-json/breeze/v1/clear-all-cache
• Consider using a WordPress security plugin to add additional authentication requirements for REST API access

# Nginx configuration to restrict access to Breeze API endpoints
location ~* /wp-json/breeze/ {
    # Allow only authenticated requests or internal network
    allow 127.0.0.1;
    allow 10.0.0.0/8;
    deny all;
}