cazzysoci/cve-breeze-2026

GitHubRepository PoCExploitPython

PoC files

4 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that checks if a WordPress site runs a vulnerable version of the Breeze plugin (CVE-2026-3844) and, if so, attempts to upload a PHP webshell via the plugin's Gravatar upload functionality to achieve remote code execution.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a single Python script (breeze.py) that claims to be a PoC exploit for CVE-2026-3844 against the WordPress Breeze plugin. The script checks the target plugin version, then attempts to upload a PHP webshell via a gravatar-related endpoint. The embedded PHP webshell provides standard file manager capabilities (browse, upload, edit, delete, download). The script's behavior is consistent with a straightforward exploit PoC: it does not contain concealed backdoor functionality, credential exfiltration, persistence mechanisms, or unrelated payloads. No obfuscation or deceptive behavior was observed.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwareWordPress Breeze Plugin
Attack typesremote code executionwebshell upload
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively uploads a PHP webshell to a remote target and verifies its accessibility, which constitutes exploitation, not just detection or scanning.

breeze.py:155-222

Requirements

  • Target must have a vulnerable version of the Breeze plugin installed (<=2.1.19 or <=2.4.4).breeze.py:34-35
  • The target's Breeze plugin must have the Gravatar upload feature enabled and accessible.breeze.py:155-222

Observed behavior

  • Checks the target's Breeze plugin version by fetching readme.txt or breeze.php and parsing the version string.breeze.py:126-145
  • Creates a local PHP webshell file (shell.php) containing file management and command execution capabilities.breeze.py:38-118breeze.py:160-162
  • Attempts to upload the webshell to the target via POST requests to multiple endpoints using the 'breeze_fetch_gravatar' action.breeze.py:168-201
  • Tests if the uploaded webshell is accessible at several predicted URLs and reports success if a 200 response is received.breeze.py:207-222
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Embedded Webshell
PHP_WEBSHELL variable (lines 38-118)The script embeds a PHP webshell that is written to a local file and uploaded to the target. The webshell is a standard file manager with no hidden or unrelated functionality.breeze.py:38-118
Exploit Behavior
Uploads webshell via POST to multiple endpointsThe exploit_gravatar_upload function attempts to upload the webshell to several WordPress endpoints, then checks for successful deployment at predictable URLs. This is normal exploit behavior.breeze.py:155-222
Review boundaries

What the analysis did not establish

  • Only the main Python script (breeze.py) was provided; 3 other files in the repository were omitted from the evidence.
  • The evidence does not include any output or logs confirming successful execution of the exploit.
  • Three additional files in the repository were not included in the text evidence; their content is unknown.
  • The analysis is limited to static review of the provided text; no dynamic execution or network analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

0

This PoC is retained in the catalog but is not currently linked to a vulnerability.