CVE-2026-79706CWE-434unrestricted-file-upload
CVE-2026-79706
Medium · published August 28, 2026
What it is
The Breeze Cache WordPress plugin before 2.5.13 does not sanitise a value taken from the request before using it to build the paths of the files it caches, allowing unauthenticated attackers to create files at arbitrary locations on the server, outside the intended cache directory.
The record
Technical detail
- CVSS v3.1
- 5.3 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00324 · 24.2th percentile
- Weakness
- CWE-434 · Unrestricted Upload of File with Dangerous Type
- Published
- 2026-08-28T12:16Z
References (1)
EPSS history
Timeline