CVE-2026-3844

root@kitploit:~

╔════════════════════════════════════════════════════════════╗
║ CVE-2026-3844                                             ║
║ Breeze Cache <= 2.4.4 Arbitrary File Upload               ║
║ Unauthenticated RCE | Authorized Lab Use Only              ║
╚════════════════════════════════════════════════════════════╝

Overview

CVE-2026-3844 is an arbitrary file upload vulnerability affecting vulnerable versions of the Breeze Cache WordPress plugin. When local Gravatar hosting is enabled, Breeze can fetch avatar URLs and store the downloaded file inside a web-accessible cache directory without sufficiently validating the file type.

How It Works

Attacker-controlled avatar URL
        |
        v
WordPress renders an avatar
        |
        v
Breeze Gravatar local-cache handler
        |
        v
download_url() fetches the remote file
        |
        v
File is saved under wp-content/cache/breeze-extra/gravatars/
        |
        v
Web-accessible uploaded file

The vulnerable behavior is in Breeze's Gravatar caching flow:

• The avatar src URL is accepted by the Breeze Gravatar handler.
• The remote file is downloaded through WordPress' download_url().
• The stored filename is derived from the remote URL path.
• Vulnerable versions do not sufficiently block dangerous extensions or validate MIME type.
• The resulting file can land in a public cache path.

Relevant vulnerable area:

inc/class-breeze-cache-cronjobs.php
fetch_gravatar_from_remote()

Requirements

Target requirements:

• WordPress site using Breeze Cache <= 2.4.4.
• Breeze plugin is active.
• Host Files Locally - Gravatars is enabled.
• The site renders avatars on at least one reachable page or endpoint.

Local lab notes:

• On localhost, this proof of concept can use a direct local cache write path when the WordPress directory is detected.
• For remote authorized testing, the script attempts to trigger the vulnerable Gravatar caching behavior through normal HTTP requests.

Installation

git clone https://github.com/AnggaTechI/CVE-2026-3844.git
cd CVE-2026-3844
python3 --version

No third-party Python packages are required. The script uses Python standard library modules only.

Usage

Run the tool:

python3 exploit.py

Single target example:

[*] Target URL or file: http://localhost/lab-wp

Target list example:

[*] Target URL or file: targets.txt
[*] Threads (default 30): 30
[*] Auto-inject on vulnerable? [y/N]: n

Example output:

[+] Loaded 1 target(s)
[+] Scanning 1 targets with 30 threads

[+] [1/1] localhost/lab-wp -> v2.4.4 gravatar=ON
[+] VULNERABLE: 1/1
[+] Saved: result.txt

Modes

Detection

The script checks whether the target appears to be WordPress, reads the Breeze plugin metadata, and compares the detected version against the vulnerable range.

Gravatar status

The script attempts to infer whether local Gravatar hosting is enabled by checking for Breeze's breeze-extra/gravatars cache references.

Authorized payload test

When auto-inject is enabled, the script attempts to verify exploitability by deploying a generated test payload and checking for its marker.

For local labs, the script may use direct filesystem access when it can identify the WordPress root. For remote authorized tests, it starts a temporary payload server and tries to trigger Breeze's Gravatar caching flow.

Expected Cache Paths

Depending on the WordPress setup, cached files may appear in one of these forms:

/wp-content/cache/breeze-extra/gravatars/<filename>
/wp-content/cache/breeze-extra/gravatars/1/<filename>

The first path is common on normal single-site WordPress installs. The second can appear when a blog/site ID is included.

Lab Checklist

Use this checklist when testing in a local WordPress lab:

• Breeze Cache 2.4.4 is installed.
• Breeze Cache is active.
• Host Files Locally - Gravatars is enabled.
• At least one avatar-rendering page is reachable.
• The cache directory exists under wp-content/cache/breeze-extra/gravatars/.
• Apache/PHP can serve files from the WordPress wp-content path.

Troubleshooting

gravatar=OFF

The plugin may be active, but Breeze has not generated local Gravatar cache files yet. Visit a page that renders avatars or call a WordPress avatar-rendering path in the lab.

not vulnerable

Common causes are patched Breeze versions, Breeze not installed, WordPress not detected at the URL, or the target path missing a subdirectory such as /lab-wp.

Injection failed

The Gravatar setting may be disabled, the site may not render avatars publicly, the cache path may not be writable, or the remote payload URL may not be reachable from the WordPress server.

Responsible Use

This repository is intended for education, local lab reproduction, and authorized security testing. Do not run it against systems you do not own or do not have explicit permission to test.

References

• NVD: CVE-2026-3844
• Wordfence Advisory
• WordPress Plugin Trac Changeset