CVE-2026-73356
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Unauthenticated Arbitrary Content Deletion in Breeze versions up to 2.5.12.
Risk Assessment
An attacker can delete arbitrary content on the site, potentially leading to data loss or disruption of the website.
Recommendation
Update the Breeze plugin to the latest version that includes the security fix.
Other vulnerabilities in Breeze
See all- CVE-2026-2128Medium
The Breeze plugin for WordPress up to version 2.5.2 exposes sensitive information to unauthenticated attackers. When caching for logged-in users is enabled, the plugin improperly verifies the 'wordpress_logged_in_' cookie, allowing attackers to impersonate an administrator and read private content.
- CVE-2025-69364Medium
The Breeze plugin for WordPress (Cloudways) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects Breeze from n/a through version 2.2.21.
Original NVD description (English source)
Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS