← back
CVE-2026-3844criticalobserved exploitationCWE-434

Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote

97Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 9.8epss 37%
from disclosure to weapon1 days
Published on NVDApr 23
1st PoC+1d
VulnCheckApr 23
exploitation probability
37%top 2% of all CVEs
observed exploitation
yesVulnCheck
11 public exploit(s)
The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability can only be exploited if "Host Files Locally - Gravatars" is enabled, which is disabled by default.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
cloudways · Breeze Cache
public PoCs found — 11
githubgithub.com/sahmsec/CVE-2026-3844★ 0githubgithub.com/rootdirective-sec/CVE-2026-3844-Lab★ 0githubgithub.com/Dhananjayasj/CVE-2026-3844-Breeze-Cache-WordPress-Plugin-Remote-Code-Execution★ 0vulncheckvulncheck.com/xdb/354d0738d45eunverifiedvulncheckvulncheck.com/xdb/724935dc0d35unverifiedvulncheckvulncheck.com/xdb/020f7ed46375unverifiedvulncheckvulncheck.com/xdb/4079d3f84af7unverifiedvulncheckvulncheck.com/xdb/a1927eae0aa0unverifiedvulncheckvulncheck.com/xdb/f990a00b12f6unverifiedvulncheckvulncheck.com/xdb/f15525b5a3b6unverifiedvulncheckvulncheck.com/xdb/690415e2b97cunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
https://plugins.trac.wordpress.org/browser/breeze/tags/2.4.1/inc/class-breeze-cache-cronjobs.php#L119https://plugins.trac.wordpress.org/browser/breeze/tags/2.4.1/inc/class-breeze-cache-cronjobs.php#L89https://plugins.trac.wordpress.org/changeset/3511463/breezehttps://www.wordfence.com/threat-intel/vulnerabilities/id/e342b1c0-6e7f-4e2c-8a52-018df12c12a0?source=cve