9.8 CriticalCWE-434
CVE-2026-3844
Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote
cloudwaysBreeze Cache
Status
- Not in CISA KEV
Exploit probabilityEPSSchecked 25 Oct
3.8%probability of exploitation in the next 30 days
Higher than 90% of scored CVEs
SeverityCVSS
9.8Critical
Description NVD
The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability can only be exploited if "Host Files Locally Gravatars" is enabled, which is disabled by default.
Coverage 2 articles · 1 outlet
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Sat 25 Apr · 15:01 UTC | Security Affairs | Over 400k WordPress sites hit by Breeze Cache flaw CVE-2026-3844 |
| Sun 26 Apr · 09:31 UTC | Security Affairs | Security Affairs newsletter Round 574 by Pierluigi Paganini – INTERNATIONAL EDITION |
- Security Affairs newsletter Round 574 by Pierluigi Paganini – INTERNATIONAL EDITIONSecurity Affairs
- Over 400k WordPress sites hit by Breeze Cache flaw CVE-2026-3844Security Affairs · first in our coverage