CVE-2026-79706 Overview
CVE-2026-79706 affects the Breeze Cache WordPress plugin in versions prior to 2.5.13. The plugin fails to sanitize a value taken from the HTTP request before using it to construct cache file paths. Unauthenticated attackers can abuse this behavior to write files at arbitrary locations on the server, outside the intended cache directory. The issue is categorized under [CWE-434] (Unrestricted Upload of File with Dangerous Type) and stems from improper input validation on request data used in filesystem operations.
Critical Impact
Unauthenticated attackers can create arbitrary files on the underlying server, enabling tampering with WordPress configuration, cached content, or other filesystem locations writable by the web server.
Affected Products
- Breeze Cache WordPress plugin versions prior to 2.5.13
- WordPress sites running vulnerable Breeze installations
- Web servers hosting affected WordPress deployments
Discovery Timeline
- 2026-08-28 - CVE-2026-79706 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-79706
Vulnerability Analysis
The Breeze Cache plugin generates cache files based on incoming HTTP request data. The plugin reads a value from the request and incorporates it into the destination path of the cached file. Because the value is not sanitized, an attacker can inject path traversal sequences or absolute path components to redirect writes outside the plugin's cache directory.
The result is an unauthenticated file creation primitive. Attackers do not need credentials, user interaction, or elevated privileges to trigger the vulnerable code path. Impact is limited to integrity: attackers can create files but do not directly gain code execution or data disclosure through this flaw alone.
See the WPScan Vulnerability Analysis for additional technical detail on the affected code path and reproduction steps.
Root Cause
The root cause is missing input validation on a request-controlled value used to build filesystem paths. The plugin trusts client-supplied input when composing the cache file location. No normalization, allow-listing, or containment check confines writes to the intended cache directory.
Attack Vector
The attack vector is network-based and requires no authentication. An attacker sends a crafted HTTP request to a WordPress site running a vulnerable Breeze Cache version. The malicious value in the request steers the plugin's file write into a directory of the attacker's choice, constrained only by filesystem permissions of the PHP process.
No verified proof-of-concept code is published in the referenced advisory. Refer to the WPScan Vulnerability Analysis for details.
Detection Methods for CVE-2026-79706
Indicators of Compromise
- Unexpected files appearing outside the Breeze cache directory, typically located under wp-content/cache/breeze/.
- New or modified files in web root directories written by the PHP or web server user without a corresponding administrative action.
- HTTP request logs containing traversal sequences such as ../ or absolute path fragments in parameters processed by Breeze.
Detection Strategies
- Audit filesystem changes across the WordPress installation and compare against expected write locations for the plugin.
- Review web server access logs for anomalous requests targeting Breeze cache endpoints with suspicious query parameters or headers.
- Deploy file integrity monitoring across wp-content/, wp-includes/, and the WordPress root to flag out-of-band file creation.
Monitoring Recommendations
- Alert on file creation events initiated by the web server process outside approved cache paths.
- Monitor for HTTP requests containing encoded traversal payloads (%2e%2e%2f, ..%2f) against WordPress endpoints.
- Correlate plugin version inventory against the 2.5.13 fixed release to identify exposed sites.
How to Mitigate CVE-2026-79706
Immediate Actions Required
- Update the Breeze Cache plugin to version 2.5.13 or later on all WordPress installations.
- Inventory WordPress sites to identify any that still run a vulnerable Breeze release.
- Review the filesystem for unexpected files created by the web server user and remove or quarantine suspicious artifacts.
Patch Information
The vendor addressed CVE-2026-79706 in Breeze Cache version 2.5.13. The fix sanitizes the request-derived value before it is used to construct cache file paths. See the WPScan Vulnerability Analysis for the fixed version reference.
Workarounds
- Disable the Breeze Cache plugin until it can be upgraded to 2.5.13 or later.
- Restrict write permissions of the PHP process so that only the intended cache directory is writable, reducing the blast radius of arbitrary file creation.
- Deploy a web application firewall rule to block requests containing path traversal sequences targeting Breeze endpoints.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
