CVE-2025-69364
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Breeze plugin for WordPress (Cloudways) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects Breeze from n/a through version 2.2.21.
Risk Assessment
The risk involves potential unauthorized access to administrative functions or data, which could lead to compromise of system integrity and confidentiality.
Recommendation
Update the Breeze plugin to a version newer than 2.2.21 and review access control configuration.
Other vulnerabilities in Breeze
See all- CVE-2026-73356High
Unauthenticated Arbitrary Content Deletion in Breeze versions up to 2.5.12.
- CVE-2026-2128Medium
The Breeze plugin for WordPress up to version 2.5.2 exposes sensitive information to unauthenticated attackers. When caching for logged-in users is enabled, the plugin improperly verifies the 'wordpress_logged_in_' cookie, allowing attackers to impersonate an administrator and read private content.
Original NVD description (English source)
Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through <= 2.2.21.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS