CVE-2026-3844: Breeze Cache for WordPress - Unauthenticated Arbitrary File Upload

Overview

Breeze Cache is a caching plugin for WordPress. According to the record, versions up to and including 2.4.4 do not validate file types in the fetch_gravatar_from_remote function, which may allow an unauthenticated visitor to place arbitrary files on the server. The Wordfence threat intelligence entry is the CNA reference in the record.

Impact

• The record classifies the flaw as unrestricted upload of a file with a dangerous type (CWE-434) and states that it may make remote code execution possible.
• The CVSS 3.1 base score is 9.8 (Critical), with high confidentiality, integrity and availability impact.
• The condition is important: the record states that exploitation is only possible when the 'Host Files Locally - Gravatars' setting is enabled, which is disabled by default.

Affected products and versions

• Cloudways Breeze Cache, versions up to and including 2.4.4, as listed in the record.
• The record lists no fixed version. This does not mean that no fix exists; it means the consulted sources do not state one.

Exploitation status

The CISA KEV entry for this CVE is not listed in the record, so no active exploitation is confirmed by that source. No confirmed exploitation appears in the sources consulted. The SSVC fields in the record show exploitation as none and automatable as yes, which means automation is considered possible, but no exploitation activity is recorded.

Remediation and mitigation

• Identify every WordPress site running Breeze Cache at version 2.4.4 or earlier.
• Watch the NVD entry and the Wordfence advisory for a corrected release, and apply it after testing once it is available.
• Check whether the 'Host Files Locally - Gravatars' option is enabled. Disabling it is an inference from the conditional description that this removes the exposed path, and it should be validated in a test environment before relying on it.
• Restrict write permissions on directories that serve public content and limit which file types can reach them.

Detection guidance

• Review upload and cache directories for recently created files, especially script-capable file types that should not exist there.
• Compare file inventories against a known-good baseline and investigate unexpected additions.
• Review web server logs for unusual requests to the plugin and for unexpected responses from newly created files.

Limitations of the available information

The record does not provide a fixed version, vendor advisory text beyond the description, or confirmation that the referenced changeset is a fix. Public proof-of-concept status, exploitation evidence after the record date, and the final patch status are unknown.

Frequently asked questions

Which Breeze Cache versions are affected by CVE-2026-3844?

The record lists the Cloudways Breeze Cache product in versions up to and including 2.4.4. No fixed version is listed in the consulted sources.

Does the vulnerability require authentication?

No. The record states that unauthenticated attackers may exploit the flaw, but only when the 'Host Files Locally - Gravatars' option is enabled, which is disabled by default.

Is this vulnerability known to be exploited in the wild?

The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted. Exploitation status should be rechecked as new information appears.

What should administrators do now?

Identify affected sites, check whether the local Gravatar hosting option is enabled, watch for a corrected plugin release, and review upload directories for unexpected files.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.