im-hanzou/cve-2026-3844Breeze Cache WordPress <=2.4.4 allows unauthenticated file upload via fetch_gravatar_from_remote when local gravatar hosting is enabled.
CVE-2026-3844 – Breeze Cache WordPress <=2.4.4 allows unauthenticated file upload via fetch_gravatar_from_remote when local gravatar hosting is enabled.
Download repository
git clone https://github.com/im-hanzou/CVE-2026-3844
Go to repository folder
cd CVE-2026-3844
Install requirements
pip install -r requirements.txt
Prepare a text file, one target per line:
https://example.com
192.168.1.1:8080
Run this command to display the usage guide
python CVE-2026-3844.py -h
Results are saved to
successful_uploads.txt — uploaded file urlsThis tool is for educational and authorized security research purposes only. The author is not responsible for any misuse or damage caused by this tool. Only use against systems you own or have explicit permission to test.