CVE-2026-79713: CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Breeze Cache
CVE-2026-79713 is a vulnerability in the Breeze Cache WordPress plugin versions from 1.2.5 up to but not including 2.5.15. The plugin fails to include certain tracking-related query parameters in its page-cache key, which causes pages requested with these parameters to be cached under the clean URL's cache entry. This allows unauthenticated attackers to have a page rendered under their own request context served to other visitors from the cached clean URL, leading to inconsistent interpretation of HTTP requests.
AI Analysis
Technical Summary
The Breeze Cache WordPress plugin before version 2.5.15 does not consider tracking-related query parameters when generating its page-cache key. As a result, pages requested with these parameters are cached under the cache key of the clean URL without parameters. An unauthenticated attacker can exploit this by causing a page rendered with their own request context to be stored and then served to subsequent visitors requesting the clean URL, effectively causing HTTP request smuggling via cache poisoning.
Potential Impact
This vulnerability allows unauthenticated attackers to poison the cache with pages rendered under their own request context. Subsequent visitors to the clean URL may receive content that reflects the attacker's context, potentially leading to information disclosure or misleading content delivery. The impact is limited to confidentiality and integrity with no availability impact reported.
Mitigation Recommendations
A fixed version of Breeze Cache is available starting from version 2.5.15. Users should upgrade to version 2.5.15 or later to remediate this vulnerability. No other mitigation actions are indicated by the vendor advisory.
CVE-2026-79713: CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Breeze Cache
Description
CVE-2026-79713 is a vulnerability in the Breeze Cache WordPress plugin versions from 1.2.5 up to but not including 2.5.15. The plugin fails to include certain tracking-related query parameters in its page-cache key, which causes pages requested with these parameters to be cached under the clean URL's cache entry. This allows unauthenticated attackers to have a page rendered under their own request context served to other visitors from the cached clean URL, leading to inconsistent interpretation of HTTP requests.
CVSS v3.1
Score 6.5medium
Affected software
Breeze Cache
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Breeze Cache WordPress plugin before version 2.5.15 does not consider tracking-related query parameters when generating its page-cache key. As a result, pages requested with these parameters are cached under the cache key of the clean URL without parameters. An unauthenticated attacker can exploit this by causing a page rendered with their own request context to be stored and then served to subsequent visitors requesting the clean URL, effectively causing HTTP request smuggling via cache poisoning.
Potential Impact
This vulnerability allows unauthenticated attackers to poison the cache with pages rendered under their own request context. Subsequent visitors to the clean URL may receive content that reflects the attacker's context, potentially leading to information disclosure or misleading content delivery. The impact is limited to confidentiality and integrity with no availability impact reported.
Mitigation Recommendations
A fixed version of Breeze Cache is available starting from version 2.5.15. Users should upgrade to version 2.5.15 or later to remediate this vulnerability. No other mitigation actions are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-08-25T13:26:01.835Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aacde7455bf5e2cf5a0355e
Added to database: 09/18/2026, 06:47:16 UTC
Last enriched: 09/18/2026, 07:01:52 UTC
Last updated: 09/18/2026, 16:59:25 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.