What is the CVSS score of CVE-2026-3844?

CVE-2026-3844 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Breeze Cache are affected by CVE-2026-3844?

CVE-2026-3844 is a critical remote code execution vulnerability in Breeze Cache for WordPress that allows unauthenticated attackers to upload malicious files when a non-default feature is enabled.

Is there a public PoC exploit available for CVE-2026-3844?

Yes, a public proof-of-concept exploit is available for CVE-2026-3844. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-3844?

Within 24 hours: Audit all WordPress installations running Breeze Cache to identify whether the 'Host Files Locally - Gravatars' feature is enabled (check Breeze settings > CDN > Gravatar options). Within 7 days: Disable the 'Host Files Locally - Gravatars' feature on all affected instances if enabled, and apply any security hardening updates from Breeze; monitor Breeze plugin repository and Wordfence advisories for patch availability. Within 30 days: Plan upgrade to patched Breeze Cache version upon vendor release; if no patch is released, evaluate alternative caching solutions without this vulnerability.

Breeze Cache CVE-2026-3844

EUVD-2026-25174 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-04-23 Wordfence

GHSA-c529-q7mw-hq6j

WordPress File Upload RCE

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 14:37 vuln.today

cvss_changed

Analysis Generated

Apr 23, 2026 - 06:46 vuln.today

EUVD ID Assigned

Apr 23, 2026 - 02:45 euvd

EUVD-2026-25174

Analysis Generated

Apr 23, 2026 - 02:45 vuln.today

CVE Published

Apr 23, 2026 - 02:25 nvd

CRITICAL 9.8

DescriptionCVE.org

The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability can only be exploited if "Host Files Locally - Gravatars" is enabled, which is disabled by default.

Articles & Coverage 1

POC CVE-2026-3844: Unauthenticated File Upload RCE in Breeze Cache WordPress Plugin (CVSS 9.8) Apr 30, 2026

AnalysisAI

Arbitrary file upload in Breeze Cache for WordPress allows unauthenticated remote attackers to upload malicious files and achieve remote code execution on vulnerable servers. Exploitation requires the non-default 'Host Files Locally - Gravatars' feature to be enabled. While CVSS rates this 9.8 critical, real-world exposure is limited by the disabled-by-default configuration requirement. No public exploit code or CISA KEV listing identified at time of analysis, though Wordfence threat intelligence has disclosed technical details including vulnerable code paths.

Technical ContextAI

This vulnerability affects the Breeze Cache WordPress plugin (cpe:2.3:a:cloudways:breeze_cache), specifically the fetch_gravatar_from_remote function in the class-breeze-cache-cronjobs.php file. The flaw is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), where the plugin fails to validate file types when fetching and storing Gravatar images locally. The gravatar caching functionality, when enabled, retrieves remote avatar images but does not properly sanitize or validate the file extensions and MIME types before writing them to the server filesystem. This allows an attacker to manipulate the gravatar fetch process to upload arbitrary PHP scripts or other executable files, which can then be accessed via direct HTTP requests to achieve code execution in the context of the web server user.

RemediationAI

Update Breeze Cache plugin to version 2.4.5 or later, which addresses the file upload validation issue per changeset 3511463 documented at https://plugins.trac.wordpress.org/changeset/3511463/breeze. Organizations unable to immediately patch should disable the 'Host Files Locally - Gravatars' feature in Breeze Cache settings as an effective temporary mitigation, noting this will revert to fetching gravatars from remote servers on each page load with minor performance impact. Additional compensating controls include implementing web application firewall rules to block direct access to the WordPress uploads directory for executable file types (.php, .phtml, .php5, etc.), though this may interfere with legitimate plugin functionality. Review web server access logs for suspicious POST requests to WordPress admin-ajax.php or cronjob endpoints, and audit the uploads directory for unexpected PHP files created during the vulnerable period. If evidence of exploitation is found, perform full incident response including malware scanning and credential rotation.