## https://sploitus.com/exploit?id=F490610E-6685-5C18-AA35-F2EAE63339C0
```text
╔════════════════════════════════════════════════════════════╗
║ CVE-2026-3844 ║
║ Breeze Cache
---
## Overview
`CVE-2026-3844` is an arbitrary file upload vulnerability affecting vulnerable versions of the
**Breeze Cache** WordPress plugin. When local Gravatar hosting is enabled, Breeze can fetch avatar
URLs and store the downloaded file inside a web-accessible cache directory without sufficiently
validating the file type.
| Field | Detail |
| --- | --- |
| CVE | CVE-2026-3844 |
| Product | Breeze Cache, WordPress Cache Plugin |
| Vendor | Cloudways |
| Vulnerability type | Unrestricted File Upload |
| CWE | CWE-434 |
| Severity | Critical, CVSS 9.8 |
| Authentication | Not required |
| Affected versions | Breeze Cache v2.4.4 gravatar=ON
[+] VULNERABLE: 1/1
[+] Saved: result.txt
```
---
## Modes
### Detection
The script checks whether the target appears to be WordPress, reads the Breeze plugin metadata, and
compares the detected version against the vulnerable range.
### Gravatar status
The script attempts to infer whether local Gravatar hosting is enabled by checking for Breeze's
`breeze-extra/gravatars` cache references.
### Authorized payload test
When auto-inject is enabled, the script attempts to verify exploitability by deploying a generated
test payload and checking for its marker.
For local labs, the script may use direct filesystem access when it can identify the WordPress root.
For remote authorized tests, it starts a temporary payload server and tries to trigger Breeze's
Gravatar caching flow.
---
## Expected Cache Paths
Depending on the WordPress setup, cached files may appear in one of these forms:
```text
/wp-content/cache/breeze-extra/gravatars/
/wp-content/cache/breeze-extra/gravatars/1/
```
The first path is common on normal single-site WordPress installs. The second can appear when a
blog/site ID is included.
---
## Lab Checklist
Use this checklist when testing in a local WordPress lab:
- Breeze Cache `2.4.4` is installed.
- Breeze Cache is active.
- `Host Files Locally - Gravatars` is enabled.
- At least one avatar-rendering page is reachable.
- The cache directory exists under `wp-content/cache/breeze-extra/gravatars/`.
- Apache/PHP can serve files from the WordPress `wp-content` path.
---
## Troubleshooting
`gravatar=OFF`
The plugin may be active, but Breeze has not generated local Gravatar cache files yet. Visit a page
that renders avatars or call a WordPress avatar-rendering path in the lab.
`not vulnerable`
Common causes are patched Breeze versions, Breeze not installed, WordPress not detected at the URL,
or the target path missing a subdirectory such as `/lab-wp`.
`Injection failed`
The Gravatar setting may be disabled, the site may not render avatars publicly, the cache path may
not be writable, or the remote payload URL may not be reachable from the WordPress server.
---
## Responsible Use
This repository is intended for education, local lab reproduction, and authorized security testing.
Do not run it against systems you do not own or do not have explicit permission to test.
---
## References
- [NVD: CVE-2026-3844](https://nvd.nist.gov/vuln/detail/CVE-2026-3844)
- [Wordfence Advisory](https://www.wordfence.com/threat-intel/vulnerabilities/id/e342b1c0-6e7f-4e2c-8a52-018df12c12a0)
- [WordPress Plugin Trac Changeset](https://plugins.trac.wordpress.org/changeset/3511463/breeze)