CVE-2026-3844 – Breeze Cache WordPress Plugin Unauthenticated RCE

CVE-2026-3844 is a critical unauthenticated arbitrary file upload vulnerability in the Breeze Cache WordPress plugin (versions ≤ 2.4.4). An attacker can post a comment containing a malicious `` tag pointing to a PHP web shell. The plugin fetches and stores the file in a publicly accessible cache directory (/wp-content/cache/breeze-extra/gravatars/), leading to Remote Code Execution (RCE).

This repository provides a fully functional Docker lab and a manual exploitation guide to reproduce the vulnerability safely.

---

📋 Table of Contents

• Vulnerability Overview
• Lab Environment (Docker)
• Exploitation Steps
  • 1. Host the Payload
  • 2. Post Malicious Comment
  • 3. Verify Upload & Execute Commands
  • 4. Reverse Shell (Optional)
• Mitigation & Remediation
• Detection
• References
• Disclaimer

---

🧠 Vulnerability Overview

Property	Details
CVE ID	CVE-2026-3844
CVSS Score	9.8 (Critical) – AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector	Network – unauthenticated HTTP POST to /wp-comments-post.php
Affected Software	WordPress Breeze Cache plugin ≤ 2.4.4
Patched Version	Breeze Cache ≥ 2.4.5
Root Cause	Missing file type validation in fetch_gravatar_from_remote() (CWE-434)
Prerequisite	"Host Files Locally – Gravatars" option must be enabled in Breeze settings

How It Works

1. The attacker hosts a PHP web shell (e.g., shell.php) on a public or local HTTP server.
2. The attacker posts a comment on any WordPress post that has comments open, with the following payload: