CVE-2026-3844

PoC exploit for CVE-2026-3844, a critical unauthenticated file upload vulnerability in the WordPress Breeze plugin leading to RCE.

---

📌 Overview

CVE-2026-3844 is a CRITICAL unauthenticated arbitrary file upload vulnerability in the Breeze Cache WordPress plugin (by Cloudways), affecting all versions up to and including 2.4.4.

This repository provides a Proof of Concept (PoC) exploit (CVE-2026-3844.py) for authorized security research, penetration testing, and responsible disclosure.

---

One Line Code

git clone https://github.com/tausifzaman/CVE-2026-3844.git && cd CVE-2026-3844 && python3

---

📊 Vulnerability Summary

Field	Details
CVE ID	CVE-2026-3844
Plugin	Breeze Cache (by Cloudways)
Affected Versions	All versions ≤ 2.4.4
Patched Version	Breeze 2.4.5+
Vulnerability Type	CWE-434 — Unrestricted Upload of File with Dangerous Type
CVSS v3.1 Score	9.8 (CRITICAL)
CVSS v2.0 Score	10.0 (CRITICAL)
CVSS Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector	Network (Remote)
Auth Required	❌ None — Unauthenticated
Condition	"Host Files Locally – Gravatars" must be enabled (disabled by default)
Impact	Confidentiality: HIGH · Integrity: HIGH · Availability: HIGH
Published	2026-04-23
Source	Wordfence / NVD / MITRE
PoC	Tausif Zaman

---

🔍 Vulnerability Details

Root Cause

The Breeze Cache plugin for WordPress fetches remote Gravatar images and stores them locally when the "Host Files Locally – Gravatars" feature is enabled. The vulnerable function fetch_gravatar_from_remote in class-breeze-cache-cronjobs.php (lines 89–119) performs no file type or extension validation on the fetched remote content.

class-breeze-cache-cronjobs.php
  └── fetch_gravatar_from_remote()   ← ❌ No file type validation
        └── Saves remote content directly to disk
              └── Attacker controls → uploads .php webshell → RCE

Attack Flow

Attacker (Unauthenticated)
    │
    ▼
Craft malicious HTTP request with PHP webshell URL as Gravatar
    │
    ▼
Plugin fetches & saves the .php file without validation
    │
    ▼
Webshell stored on server (e.g., /wp-content/breeze-cache/evil.php)
    │
    ▼
Attacker accesses webshell → Full RCE achieved

Impact

If successfully exploited, an attacker can:

• 🔴 Execute arbitrary operating system commands (RCE)
• 🔴 Upload persistent backdoors / webshells
• 🔴 Create rogue WordPress administrator accounts
• 🔴 Exfiltrate databases, credentials, and sensitive files
• 🔴 Deface the website or delete all content
• 🔴 Use the server to pivot to other systems on the same network
• 🔴 Recruit the server into a botnet

---

⚙️ Requirements

• Python 3.6+
• requests library
• Target site running Breeze Cache ≤ 2.4.4 with "Host Files Locally – Gravatars" enabled

---

🚀 Installation & Setup

🐧 Linux / Termux (Android)

# Clone the repository
git clone https://github.com/tausifzaman/CVE-2026-3844.git && cd CVE-2026-3844 && python3 CVE-2026-3844.py

# Navigate into the directory
cd CVE-2026-3844

# Install dependencies
pip install -r requirements.txt

# Run the exploit
python3 CVE-2026-3844.py

🪟 Windows (CMD / PowerShell)

git clone https://github.com/tausifzaman/CVE-2026-3844.git
cd CVE-2026-3844
pip install -r requirements.txt
python CVE-2026-3844.py

🍎 macOS

git clone https://github.com/tausifzaman/CVE-2026-3844.git
cd CVE-2026-3844
pip3 install -r requirements.txt
python3 CVE-2026-3844.py

🤖 Termux (One-Liner)

pkg install python git -y && git clone https://github.com/tausifzaman/CVE-2026-3844.git && cd CVE-2026-3844 && pip install -r requirements.txt && python3 CVE-2026-3844.py

☁️ Google Cloud Shell (No Setup Needed)

git clone https://github.com/tausifzaman/CVE-2026-3844.git && cd CVE-2026-3844 && pip install -r requirements.txt && python3 CVE-2026-3844.py

---

💻 Usage

python3 CVE-2026-3844.py

Options

usage: CVE-2026-3844.py [-h] -u URL [-t TIMEOUT] [-o OUTPUT] [-v]

CVE-2026-3844 — Breeze Cache WordPress Plugin Arbitrary File Upload PoC

optional arguments:
  -h, --help              Show this help message and exit
  -u URL, --url URL       Target URL (e.g. https://target.com)
  -t TIMEOUT              Request timeout in seconds (default: 10)
  -o OUTPUT               Save webshell path to output file
  -v, --verbose           Enable verbose/debug output

Examples

# Basic usage
python3 CVE-2026-3844.py -u https://vulnerable-site.com

# Verbose mode
python3 CVE-2026-3844.py -u https://vulnerable-site.com -v

# Custom timeout
python3 CVE-2026-3844.py -u https://vulnerable-site.com -t 20 -v

---

🖥️ PoC Demo Output

╔══════════════════════════════════════════════════════╗
║          CVE-2026-3844 | Breeze Cache WP RCE        ║
║          Researcher: tausifzaman.online              ║
╚══════════════════════════════════════════════════════╝