CVE-2026-79706: CWE-434 Unrestricted Upload of File with Dangerous Type in Breeze Cache

The Breeze Cache WordPress plugin versions prior to 2.5.13 contain an unrestricted file upload vulnerability (CWE-434). The plugin does not properly sanitize a value taken from user requests before using it to build file paths for caching. This allows unauthenticated attackers to write files to arbitrary locations on the server, bypassing intended directory restrictions. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts integrity without affecting confidentiality or availability.

An unauthenticated attacker can create files at arbitrary locations on the server hosting the Breeze Cache plugin. This unauthorized file creation could be leveraged to alter server behavior or plant malicious files, impacting the integrity of the system. There is no direct impact on confidentiality or availability reported.

No official patch or remediation guidance is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should monitor official Breeze Cache plugin channels for updates and consider restricting access to the plugin or disabling it if possible to reduce exposure.