CVE-2026-3844

CRITICAL EXPLOITED

Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote

Title source: cna

Description

The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability can only be exploited if "Host Files Locally - Gravatars" is enabled, which is disabled by default.

Exploits (3)

nomisec WORKING POC
by tausifzaman · poc
https://github.com/tausifzaman/CVE-2026-3844
nomisec WORKING POC
by 0xgh057r3c0n · remote
https://github.com/0xgh057r3c0n/CVE-2026-3844
nomisec WORKING POC
by im-hanzou · remote
https://github.com/im-hanzou/CVE-2026-3844

References (4)

Scores

CVSS v3 9.8
EPSS 0.0006
EPSS Percentile 18.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2026-04-23
CWE
CWE-434
Status published
Products (1)
cloudways/Breeze Cache < 2.4.4
Published Apr 23, 2026
Tracked Since Apr 23, 2026