CVE-2026-3844

This repository contains a functional exploit for CVE-2026-3844, an unauthenticated file upload vulnerability in the WordPress Breeze plugin (versions up to 2.4.4). The exploit leverages the `breeze_fetch_gravatar` action to upload a PHP webshell, achieving remote code execution (RCE).

This repository contains a functional exploit for CVE-2026-3844, an unauthenticated arbitrary file upload vulnerability in the Breeze Cache WordPress plugin (≤ 2.4.4). The exploit leverages a flaw in the `fetch_gravatar_from_remote` function to upload a malicious PHP shell, leading to remote code execution.

This repository contains a functional exploit for CVE-2026-3844, an unauthenticated arbitrary file upload vulnerability in the Breeze Cache WordPress plugin (versions <= 2.4.4). The exploit leverages a malicious comment with a crafted `srcset` attribute to upload a remote payload, which is then cached and executed by the plugin.

This repository contains a functional exploit for CVE-2026-3844, targeting Breeze Cache <= 2.4.4. The exploit leverages unauthenticated arbitrary file upload via comment injection to achieve RCE.

This repository contains a functional exploit for CVE-2026-3844, targeting Breeze Cache for WordPress. It demonstrates three distinct vectors for unauthenticated PHP file write, leading to remote code execution (RCE).

This repository contains a functional exploit PoC for CVE-2026-3844, demonstrating an unauthenticated arbitrary file upload vulnerability in the Breeze Cache WordPress plugin (version 2.4.4) leading to remote code execution (RCE). The lab includes a Docker-based environment with vulnerable and patched versions of the plugin, along with a proof-of-concept script that triggers the vulnerability via a crafted comment with a controlled `srcset` string.

This repository contains a functional Python exploit for CVE-2026-3844, an unauthenticated arbitrary file upload vulnerability in WordPress Breeze Cache <= 2.4.4. The exploit leverages a malicious comment with a crafted `srcset` attribute to trigger file upload via the caching mechanism.

This repository contains a functional exploit for CVE-2026-3844, demonstrating an unauthenticated arbitrary file upload vulnerability in Breeze Cache <= 2.4.4, leading to remote code execution (RCE). The exploit leverages a lack of MIME type validation and file extension restrictions in the `fetch_gravatar_from_remote()` function, allowing an attacker to upload a malicious PHP file via a crafted comment.

This repository contains a functional exploit PoC for CVE-2026-3844, an unauthenticated file upload vulnerability in the WordPress Breeze plugin leading to RCE. The exploit automates version detection and payload delivery via the `breeze_fetch_gravatar` action.

This repository contains a functional Python exploit for CVE-2026-3844, an unauthenticated arbitrary file upload vulnerability in WordPress Breeze Cache <= 2.4.4. The exploit leverages a malicious comment with a crafted `srcset` attribute to trigger file caching, resulting in remote code execution.

This repository contains a functional Python exploit for CVE-2026-3844, targeting a Breeze Cache arbitrary file upload vulnerability in WordPress. The exploit automates the process of uploading a malicious file via a crafted comment submission and verifies successful uploads.