CVE-2026-83627

CVE-2026-83627 is a critical, unauthenticated remote code execution flaw in the Hummingbird speed-optimization plugin for WordPress, affecting all versions up to and including 3.21.0. The page-cache debug log is written to the directly web-accessible file wp-content/wphb-logs/page-caching-log.php, whose protective '<?php die(); ?>' header is guarded by a class_exists('Filesystem') check that can never match (the class actually lives in Hummingbird\Core), so the header is omitted whenever the log is created during a front-end request — via the plugin's Clear logs action, a cache flush, or unattended through the daily log-rotation cron — and get_cookies() then writes raw wphb_cache_-prefixed cookie names into the file without sanitization. An unauthenticated attacker can therefore send a single anonymous request with malicious PHP in a wphb_cache_ cookie and execute it by loading the log file directly, gaining full remote code execution under the web server's account. Only sites where an administrator enabled Page Caching together with the non-default Debug Log option are exposed. No public proof-of-concept or confirmed in-the-wild exploitation is known; EPSS currently assigns a 0.8% probability of exploitation within 30 days, and the issue is not in the CISA KEV catalog.

What to do: Update the Hummingbird plugin to the first fixed release (any version newer than 3.21.0) as soon as possible; until then, disable the Page Caching Debug Log option and delete or block direct web access to wp-content/wphb-logs/page-caching-log.php. Inspect the log file for injected PHP (e.g., content following unexpected wphb_cache_ cookie names) and review web-server access logs for anonymous requests to that path, since successful exploitation grants code execution under the web-server account and can lead to full site compromise.