WordPress Hummingbird <= 3.18.0 - Sensitive Information Exposure via Log File

Hummingbird Performance WordPress plugin = 3.18.0 contains a sensitive information exposure caused by improper handling in the 'request' function, letting unauthenticated attackers extract sensitive data including Cloudflare API credentials, exploit requires no authentication. id: CVE-2025-14437...

CVE-2026-83627

The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the logmsg function in core/modules/class-page-cache.php. The page-cache debug log is written to...

EUVD-2026-71839

The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the logmsg function in core/modules/class-page-cache.php. The page-cache debug log is written to...

CVE-2026-83627

The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress (versions ≤ 3.21.0 ) is vulnerable to unauthenticated remote code execution via a flaw in the page cache debug log. The protective

CVE-2026-83627 Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log

The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the logmsg function in core/modules/class-page-cache.php. The page-cache debug log is written to...

PT-2026-86312

Name of the Vulnerable Software and Affected Versions Hummingbird versions prior to 3.21.1 Description Remote Code Execution is possible via the log msg function in core/modules/class-page-cache.php. The page-cache debug log is written to a web-accessible PHP file that fails to maintain a...

WordPress Hummingbird - Speed Optimization, Caching, Minify, Compress & CDN plugin <= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log vulnerability

WordPress Hummingbird - Speed Optimization, Caching, Minify, Compress & CDN plugin = 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log vulnerability discovered by Kuba in WordPress Plugin Hummingbird versions = 3.21.0...

CVE-2026-19224

The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

EUVD-2026-70902

The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

CVE-2026-19224

CVE-2026-19224 affects the Hummingbird Performance WordPress plugin in versions prior to 3.21.2 . The vulnerability resides in the Hub Connector component, which fails to restrict a network-wide setting to network administrators , allowing any site administrator on a WordPress multisite network t...

CVE-2026-19224 Hummingbird < 3.21.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite

The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

WordPress Hummingbird Performance plugin < 3.21.2 - Admin+ Network-Wide RCE vulnerability

Admin+ Network-Wide RCE vulnerability discovered by Jakub Herman in WordPress Plugin Hummingbird versions 3.21.2...

CVE-2026-43678

An unauthenticated remote peer can crash any NIOWebSocket-based server including Vapor and Hummingbird with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0...

CVE-2026-43678

CVE-2026-43678 is a Denial of Service vulnerability in swift-nio 's NIOWebSocket component. An unauthenticated remote attacker can crash any NIOWebSocket-based server—including the Vapor and Hummingbird frameworks—by sending a single 11-byte frame after a completed WebSocket handshake. This drops...

CVE-2026-43678

An unauthenticated remote peer can crash any NIOWebSocket-based server including Vapor and Hummingbird with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0...

GHSA-RJ37-6J9X-74Q6 SwiftNIO NIOHTTP1: HTTPDecoder accepts unbounded HTTP/1 header blocks, enabling remote DoS

Summary The HTTPDecoder in NIOHTTP1 enforces no limit on the total size of an HTTP/1 message's header block or on the number of header fields per message. A remote peer can submit an arbitrary number of small, valid headers in a single request and have them all accumulated into the resulting...

VulnCheck KEV: CVE-2025-14437

The Hummingbird Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.18.0 via the 'request' function. This makes it possible for unauthenticated attackers to extract sensitive data including Cloudflare API credentials...

CVE-2022-0994

The Hummingbird WordPress plugin before 3.3.2 does not sanitise and escape the Config Name, which could allow high privilege users, such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2025-14437

The Hummingbird Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.18.0 via the 'request' function. This makes it possible for unauthenticated attackers to extract sensitive data including Cloudflare API credentials...

WordPress Hummingbird plugin <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log File vulnerability

Unauthenticated Sensitive Information Exposure via Log File vulnerability discovered by ISMAILSHADOW in WordPress Plugin Hummingbird versions = 3.18.0...