Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-3844 — Exploit for CVE-2026-3844, an unauthenticated arbitrary file upload leading to RCE in Breeze Cache WordPress plugin. Includes lab setup, usage, and IoCs for authorized testing. | Kitploit
Tools/GitHubGitHub/halilkirazkaya/cve-2026-3844
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & EducationRed Teaming
GitHubhalilkirazkaya/cve-2026-3844

CVE-2026-3844

Exploit for CVE-2026-3844, an unauthenticated arbitrary file upload leading to RCE in Breeze Cache WordPress plugin. Includes lab setup, usage, and IoCs for authorized testing.

View Repository
43 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-3844 — Breeze Cache RCE

Unauthenticated Arbitrary File Upload → Remote Code Execution

FieldValue
CVECVE-2026-3844
CVSS9.8 (Critical)
PluginBreeze Cache (Cloudways)
Affected≤ 2.4.4
Fixed2.4.5
Discovered byHung Nguyen (bashu)
PoC byhalilkirazkaya

Overview

Breeze Cache WordPress plugin (≤ 2.4.4) contains a critical arbitrary file upload vulnerability. Attackers are actively exploiting this flaw to gain Remote Code Execution (RCE) and complete website takeover without any authentication.

The flaw lives in the fetch_gravatar_from_remote function inside class-breeze-cache-cronjobs.php. The function fetches Gravatar images from a remote URL and stores them locally in the WordPress uploads directory without validating the file type or content.

Technical Breakdown

  • Vulnerable Function: fetch_gravatar_from_remote
  • Mechanism: The plugin attempts to mirror Gravatar images locally to improve performance. By controlling the author metadata (specifically srcset or src via comment injection), an attacker can force the server to download a malicious PHP shell from a remote URL.
  • Prerequisite: The "Host Files Locally - Gravatars" option must be enabled (disabled by default).
  • Exploitation Status: Actively exploited in the wild with thousands of attempts reported by Wordfence.

Lab Setup

1. Download Vulnerable Plugin

root@kitploit:~
wget https://downloads.wordpress.org/plugin/breeze.2.4.4.zip
unzip breeze.2.4.4.zip
rm breeze.2.4.4.zip

2. Start the Environment

root@kitploit:~
docker compose up -d

3. Configure WordPress

  1. Open http://localhost and complete the WordPress installation.
  2. Go to Plugins → Installed Plugins and activate Breeze.
  3. Go to Breeze → Settings and enable Host Files Locally - Gravatars.

Breeze Settings

4. Install Dependencies

root@kitploit:~
pip install -r requirements.txt

Usage

root@kitploit:~
# Check vulnerability only (reads version from readme.txt)
python3 exploit.py -u http://TARGET-URL -c

# Run full exploit (injection + trigger + shell check)
python3 exploit.py -u http://TARGET-URL

Exploit Success

Mitigation & IoCs

Mitigation

  • Update: Upgrade to Breeze Cache 2.4.5 or later.
  • Interim Fix: Disable the "Host Files Locally - Gravatars" option in settings.

Indicators of Compromise (IoCs)

  • Files: Check /wp-content/cache/breeze-extra/gravatars/ (or /uploads/breeze/gravatars/) for unexpected .php, .phtml, or .phar files.
  • Logs: Review web server access logs for requests to admin-ajax.php or wp-cron.php related to fetch_gravatar_from_remote parameters.
  • Network: Monitor outbound connections from the web server to unfamiliar external URLs.

Disclaimer

This tool is provided for authorized security testing and educational purposes only. Unauthorized access to computer systems is illegal. Use responsibly.

Download Tool