Dhananjayasj/CVE-2026-3844-Breeze-Cache-WordPress-Plugin-Remote-Code-Execution

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
AnalysisSuspicious behaviordeepseek-v4-pro:cloud ·

Technical assessment

A Python script that exploits CVE-2026-3844, an unauthenticated arbitrary file upload vulnerability in the Breeze Cache WordPress plugin, by posting a malicious comment to trigger the plugin to fetch and cache a remote PHP webshell, leading to remote code execution.

Backdoor review

Suspicious behavior

The PoC script (CVE-2026-3844.py) exploits a disclosed arbitrary file upload vulnerability in the Breeze Cache WordPress plugin. However, it contains a hardcoded default payload URL pointing to a third-party GitHub Gist (im-hanzou) and a hardcoded success verification string, which are used automatically without operator configuration. The script's documentation and help text present the payload as operator-configurable, but the default behavior silently fetches and executes a remote webshell from an external, unvetted source. This material contradiction between the presented configurability and the automatic use of a hardcoded external payload creates concern, though direct evidence of concealed harm is not established.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareWordPress Breeze Cache plugin
Attack typesArbitrary File UploadRemote Code Execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively performs the steps to upload and execute a remote payload on a vulnerable target, including sending a malicious comment, waiting for caching, and verifying code execution. This constitutes an exploit, not merely a scanner or writeup.

CVE-2026-3844.py:119-186CVE-2026-3844.py:202-273

Requirements

  • The 'Host Files Locally - Gravatars' option must be enabled in Breeze Cache settings.CVE-2026-3844.py:234-235
  • The target WordPress site must have comments enabled on at least one post.CVE-2026-3844.py:139
  • A remote payload (e.g., a PHP webshell) must be hosted on an accessible HTTP server.CVE-2026-3844.py:203

Observed behavior

  • Checks if the target is running a vulnerable version of Breeze Cache (≤ 2.4.4) by fetching readme.txt.CVE-2026-3844.py:93-117
  • Sends a POST request to /wp-comments-post.php with a crafted comment containing an img srcset tag pointing to a remote payload URL.CVE-2026-3844.py:137-141
  • Waits for the Breeze plugin to fetch and cache the remote file, then checks for its presence in the gravatars cache directory.CVE-2026-3844.py:152-164
  • Verifies successful exploitation by checking for a predefined verification string in the uploaded file's response.CVE-2026-3844.py:169-170
  • Tests the uploaded webshell by sending a command and checking the response.CVE-2026-3844.py:188-200
Safety-review evidence

Behaviors behind the backdoor verdict

Flagged behaviors

Concealed Default Behavior
  • The script defines a hardcoded DEFAULT_PAYLOAD pointing to an external GitHub Gist (user im-hanzou) and a hardcoded DEFAULT_SUCCESS_STRING. These are used automatically in the exploit() function without requiring the operator to supply a payload, contradicting the script's own help text which presents the payload as an optional argument.CVE-2026-3844.py:203-204CVE-2026-3844.py:212CVE-2026-3844.py:238

Observables

Url
https://gist.githubusercontent.com/im-hanzou/1768625b0492df34c32fc394835da595/raw/fbe555d4243f90cc0b01c5e2d676453823dfcf9c/CVE-2026-3844.phpHardcoded default payload URL used when the operator does not supply a custom payload. The payload is fetched and stored on the target server.CVE-2026-3844.py:203
String
4356452d323032362d33383434Hardcoded default success verification string (hex for 'CVE-2026-3844') used to confirm successful exploitation when the default payload is used.CVE-2026-3844.py:204
Review boundaries

What the analysis did not establish

  • One file (likely a Dockerfile or similar) was omitted from the text evidence; its content is not available for analysis.
  • The README.md file is truncated at line 47, so the full exploitation guide and Docker lab details are not fully visible.
  • The content of the hardcoded default payload (CVE-2026-3844.php) is not included in the evidence, preventing analysis of its behavior.
  • The repository contains one unclassified file (likely the Docker lab) that was not inspected, but it is not part of the PoC script's execution path.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1