CVE-2026-3844

This flaw lets a stranger add files to your website’s server, as if they could drop anything they want into your website storage. If the wrong feature is enabled (“Host Files Locally - Gravatars”), those uploaded files could be used to take over the site or execute commands on the server. Think of it like an unlocked side door: most buildings are fine, but if the door is actually left unlocked, someone can get in.

This matters if you run the WordPress plugin “Breeze Cache” at version 2.4.4 or earlier. The risk is specifically tied to whether “Host Files Locally - Gravatars” is enabled, which is disabled by default, so many sites won’t be reachable from outside unless that feature is turned on. Reachability gate: only a risk if the vulnerable plugin version is installed AND “Host Files Locally - Gravatars” is enabled.

This is RED because attackers can upload files without logging in if a specific Breeze Cache feature is enabled. Press attention indicates active interest and potential targeting, and the overall risk likelihood is rising. Even though the default configuration is safer, you should check your setting and disable it immediately if you’re in an affected configuration.

1. Confirm exposure (do this first)

   • In WordPress admin, locate “Breeze Cache” and note the installed version.
   • Go to Breeze Cache settings and check whether “Host Files Locally - Gravatars” is enabled.

2. Determine if you are vulnerable

   • You are in the affected version set if Breeze Cache is <= 2.4.4.
   • You are only at real upload risk if “Host Files Locally - Gravatars” is enabled (it is disabled by default).

3. Immediate mitigation (temporary workaround)

   • If “Host Files Locally - Gravatars” is enabled on an affected version, disable it right away.
   • If you cannot access the setting quickly, contact your WordPress support/host to turn it off.

4. Patch/upgrade plan

   • Available patch information is not provided here (“no fix/patch information available”), so your technical team should check the Breeze Cache plugin changelog/release notes for a version that addresses CVE-2026-3844.
   • If a fixed update exists for your installed branch, upgrade to that fixed version.
   • If no fixed version exists, consider moving to a version/plugin alternative with the feature removed or properly validated upload handling.

5. What to monitor

   • Review WordPress server logs for unusual POST/upload activity involving plugin endpoints.
   • Check for unexpected new files in your WordPress content/upload directories and any places where the plugin may write files.
   • Watch for signs of website defacement or unexpected admin accounts appearing soon after changes.

6. Communication

   • Document the current version and whether the setting was on, and share this with your IT/hosting provider to speed up the safe remediation path.

CVE-2026-3844 is a high-impact (CRITICAL) arbitrary file upload issue (CWE-434) in the Breeze Cache WordPress plugin. The mechanism is missing file-type validation in fetch_gravatar_from_remote, which allows unauthenticated attackers to upload arbitrary files to the target server running Breeze Cache. The vulnerability is gated by the “Host Files Locally - Gravatars” feature (disabled by default), meaning many default installations are not exposed.

Exploitation context: KEV listing was not found for this CVE, and no public exploit code is on record in the provided findings. However, press attention is sustained, and the overall assessed likelihood is rising (EPSS is predicted), while exploitation is not confirmed via dated KEV/news in the provided sources.

What KEV means here: KEV (CISA Known Exploited Vulnerabilities) would indicate confirmed active exploitation. Since KEV is not listed in the provided findings, treat confirmation as not yet established from KEV, but the RED verdict still reflects the severe impact if the reachability gate is met.