CVE-2026-3844: WordPress Breeze Cache Plugin RCE Flaw

CVE-2026-3844 Overview

The Breeze Cache plugin for WordPress contains a critical arbitrary file upload vulnerability in the fetch_gravatar_from_remote function. Due to missing file type validation, unauthenticated attackers can upload arbitrary files to the affected site's server, potentially enabling remote code execution. This vulnerability affects all versions of the Breeze Cache plugin up to and including version 2.4.4.

The vulnerability is only exploitable when the "Host Files Locally - Gravatars" option is enabled in the plugin settings. While this feature is disabled by default, sites that have enabled local Gravatar hosting are at significant risk.

Critical Impact

Unauthenticated attackers can upload arbitrary files including PHP webshells, enabling complete server compromise through remote code execution.

Affected Products

• Breeze Cache Plugin for WordPress versions up to and including 2.4.4
• WordPress sites with "Host Files Locally - Gravatars" feature enabled

Discovery Timeline

• April 23, 2026 - CVE-2026-3844 published to NVD
• April 23, 2026 - Last updated in NVD database

Technical Details for CVE-2026-3844

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The fetch_gravatar_from_remote function in the Breeze Cache plugin fails to properly validate file types when downloading and storing Gravatar images locally.

When the "Host Files Locally - Gravatars" feature is enabled, the plugin fetches user avatar images from remote sources and stores them on the local server. The vulnerable function does not verify that the downloaded content is actually an image file, nor does it restrict the file extensions that can be saved to the server.

An attacker can exploit this by manipulating the Gravatar source to point to a malicious file (such as a PHP webshell) instead of a legitimate image. Since no validation occurs, the malicious file is saved to the server with an attacker-controlled filename and extension, enabling arbitrary code execution when accessed directly.

Root Cause

The root cause of this vulnerability is the absence of file type validation in the fetch_gravatar_from_remote function located in class-breeze-cache-cronjobs.php. The function accepts remote file content without verifying:

1. The MIME type of the downloaded content
2. The file extension of the saved file
3. The actual file contents match expected image formats

This allows attackers to bypass intended restrictions and upload executable files disguised as Gravatar images.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying a WordPress site running a vulnerable version of Breeze Cache with local Gravatar hosting enabled
2. Crafting a malicious request that triggers the fetch_gravatar_from_remote function with a controlled source URL
3. Hosting a malicious PHP file (webshell) at the attacker-controlled URL
4. The plugin fetches and stores the malicious file on the target server
5. The attacker accesses the uploaded file directly to execute arbitrary code

The vulnerability is particularly dangerous because it requires no authentication, allowing any remote attacker to attempt exploitation against vulnerable sites.

Detection Methods for CVE-2026-3844

Indicators of Compromise

• Unexpected PHP files in WordPress cache directories or Gravatar storage locations
• Web server access logs showing requests to unusual files in plugin directories
• New files with executable extensions (.php, .phtml, .phar) in Gravatar cache folders
• Outbound connections from the web server to attacker-controlled infrastructure

Detection Strategies

• Monitor file creation events in WordPress plugin directories, particularly in Breeze Cache storage locations
• Implement file integrity monitoring to detect unauthorized file additions in the WordPress installation
• Review web server access logs for requests to unexpected PHP files in cache directories
• Deploy web application firewall (WAF) rules to detect file upload exploitation attempts

Monitoring Recommendations

• Enable real-time file system monitoring on WordPress directories
• Configure alerts for new executable files created in plugin cache directories
• Monitor web server processes for unusual child process execution patterns
• Implement logging for all file operations performed by the Breeze Cache plugin

How to Mitigate CVE-2026-3844

Immediate Actions Required

• Update the Breeze Cache plugin to the latest patched version immediately
• Disable the "Host Files Locally - Gravatars" feature until the plugin is updated
• Review Gravatar cache directories for any suspicious or unexpected files
• Audit web server access logs for potential exploitation attempts

Patch Information

The vulnerability has been addressed in the Breeze Cache plugin. Security patches can be obtained through the official WordPress plugin repository. The WordPress Breeze Changeset contains the specific code changes that remediate this vulnerability.

For additional details about the vulnerability, refer to the Wordfence Vulnerability Report.

Workarounds

• Disable the "Host Files Locally - Gravatars" option in Breeze Cache settings (this is the default configuration)
• Implement server-level restrictions to prevent PHP execution in cache directories
• Use .htaccess rules to deny direct access to files in Gravatar cache directories
• Consider temporarily deactivating the Breeze Cache plugin until patching is complete

# Configuration example - Disable PHP execution in cache directories
# Add to .htaccess in the Breeze cache directory

<FilesMatch "\.(?:php|phtml|phar)$">
    Order Deny,Allow
    Deny from all
</FilesMatch>