CVE-2026-3844criticalexplotación observadaCWE-434

CVE-2026-3844: fallo crítico en cloudways Breeze Cache

Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote

Publicada el

85Vexday Risk Score

Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.

ssvc Actcvss 9.8epss 3.8%
de la publicación al arma1 días
Publicada en NVD23 abr
1ª PoC+1d
VulnCheck23 abr
probabilidad de explotación
3.8%top 10% de las CVE
explotación observada
síVulnCheck
11 exploit(s) público(s)
The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability can only be exploited if "Host Files Locally - Gravatars" is enabled, which is disabled by default.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
cloudways · Breeze Cache
PoCs públicas encontradas — 11
githubgithub.com/sahmsec/CVE-2026-3844★ 0githubgithub.com/rootdirective-sec/CVE-2026-3844-Lab★ 0githubgithub.com/Dhananjayasj/CVE-2026-3844-Breeze-Cache-WordPress-Plugin-Remote-Code-Execution★ 0vulncheckvulncheck.com/xdb/354d0738d45eno verificadovulncheckvulncheck.com/xdb/724935dc0d35no verificadovulncheckvulncheck.com/xdb/020f7ed46375no verificadovulncheckvulncheck.com/xdb/4079d3f84af7no verificadovulncheckvulncheck.com/xdb/a1927eae0aa0no verificadovulncheckvulncheck.com/xdb/f990a00b12f6no verificadovulncheckvulncheck.com/xdb/f15525b5a3b6no verificadovulncheckvulncheck.com/xdb/690415e2b97cno verificado
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — cloudways Breeze Cache

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-13864MEDIUMBreeze – WordPress Cache Plugin <= 2.2.21 - Missing Authorization to Cache DeletionEPSS 0.4%CVE-2026-2128MEDIUMBreeze Cache <= 2.5.2 - Unauthenticated Exposure of Sensitive Information to an Unauthorized Actor via Crafted Login CookieEPSS 0.3%
Referencias
https://plugins.trac.wordpress.org/browser/breeze/tags/2.4.1/inc/class-breeze-cache-cronjobs.php#L119https://plugins.trac.wordpress.org/browser/breeze/tags/2.4.1/inc/class-breeze-cache-cronjobs.php#L89https://plugins.trac.wordpress.org/changeset/3511463/breezehttps://www.wordfence.com/threat-intel/vulnerabilities/id/e342b1c0-6e7f-4e2c-8a52-018df12c12a0?source=cve