CVE-2026-3844criticalobserved exploitationCWE-434

CVE-2026-3844: critical vulnerability in cloudways Breeze Cache

Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote

Published

85Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 9.8epss 3.8%
from disclosure to weapon1 days
Published on NVDApr 23
1st PoC+1d
VulnCheckApr 23
exploitation probability
3.8%top 10% of all CVEs
observed exploitation
yesVulnCheck
11 public exploit(s)
The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability can only be exploited if "Host Files Locally - Gravatars" is enabled, which is disabled by default.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
cloudways · Breeze Cache
public PoCs found — 11
githubgithub.com/sahmsec/CVE-2026-3844★ 0githubgithub.com/rootdirective-sec/CVE-2026-3844-Lab★ 0githubgithub.com/Dhananjayasj/CVE-2026-3844-Breeze-Cache-WordPress-Plugin-Remote-Code-Execution★ 0vulncheckvulncheck.com/xdb/354d0738d45eunverifiedvulncheckvulncheck.com/xdb/724935dc0d35unverifiedvulncheckvulncheck.com/xdb/020f7ed46375unverifiedvulncheckvulncheck.com/xdb/4079d3f84af7unverifiedvulncheckvulncheck.com/xdb/a1927eae0aa0unverifiedvulncheckvulncheck.com/xdb/f990a00b12f6unverifiedvulncheckvulncheck.com/xdb/f15525b5a3b6unverifiedvulncheckvulncheck.com/xdb/690415e2b97cunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — cloudways Breeze Cache

In the same product, most dangerous first.

CVE-2025-13864MEDIUMBreeze – WordPress Cache Plugin <= 2.2.21 - Missing Authorization to Cache DeletionEPSS 0.4%CVE-2026-2128MEDIUMBreeze Cache <= 2.5.2 - Unauthenticated Exposure of Sensitive Information to an Unauthorized Actor via Crafted Login CookieEPSS 0.3%
References
https://plugins.trac.wordpress.org/browser/breeze/tags/2.4.1/inc/class-breeze-cache-cronjobs.php#L119https://plugins.trac.wordpress.org/browser/breeze/tags/2.4.1/inc/class-breeze-cache-cronjobs.php#L89https://plugins.trac.wordpress.org/changeset/3511463/breezehttps://www.wordfence.com/threat-intel/vulnerabilities/id/e342b1c0-6e7f-4e2c-8a52-018df12c12a0?source=cve