Over 400,000 sites at risk as hackers exploit Breeze Cache plugin flaw (CVE-2026
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-3844 | Unauthenticated Arbitrary File Upload in Breeze Cache WordPress Plugin CVE-2026-3844 is a critical (CVSS 9.8) arbitrary file upload vulnerability in the Breeze Cache plugin for WordPress, caused by missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to and including 2.4.4. An unauthenticated attacker can trigger the function over the network and upload arbitrary files to the affected site's server, but the flaw is only exploitable when the 'Host Files Locally - Gravatars' option is enabled, which is disabled by default. Uploaded files can include executable PHP such as web shells, so successful exploitation may make remote code execution and full site or server compromise possible. Any WordPress site running Breeze Cache 2.4.4 or earlier with local Gravatar hosting switched on is affected, and press coverage reports more than 400,000 sites at risk. Headlines indicate attackers are already exploiting the flaw in the wild; no public proof-of-concept is known, the EPSS score of 27.7% (98th percentile) signals high near-term exploitation risk, and the CVE is not yet in CISA's KEV. Do: Sites running Breeze Cache should update to the latest patched release (any version after 2.4.4); if updating is not immediately possible, disable the 'Host Files Locally - Gravatars' setting to close the attack path. Administrators should also audit uploaded files and the webroot for unexpected PHP files or web shells and check site integrity for signs of compromise, given reports of active exploitation and related WordPress backdoor campaigns. | 9.8 | 28% |
| mass≈400,000+ WordPress sites at risk |
Full article324 words · extracted from securityaffairs.com · click to collapse
Attackers exploit a Breeze Cache flaw (CVE-2026-3844) to upload files without login. Wordfence researchers detected over 170 attacks.
Threat actors are exploiting a critical flaw, tracked as CVE-2026-3844 (CVSS score of 9.8), in the Breeze Cache WordPress plugin, allowing them to upload files to a server without authentication. The vulnerability has already been used in over 170 attack attempts detected by Wordfence.
Breeze Cache is a free WordPress plugin developed by Cloudways that improves website speed and performance. It offers page and browser caching, file minification, Gzip compression, and CDN integration, helping reduce load times and optimize overall site delivery. The plugin is currently installed on over 400,000 websites.
The security researcher Hung Nguyen (bashu) discovered the vulnerability.
“The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ‘fetch_gravatar_from_remote’ function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site’s server which may make remote code execution possible.” reads the report published by Wordfence. “The vulnerability can only be exploited if “Host Files Locally – Gravatars” is enabled, which is disabled by default.”
Wordfence researchers say the flaw stems from missing file-type validation in the ‘fetch_gravatar_from_remote’ function, allowing unauthenticated attackers to upload arbitrary files. This can lead to remote code execution and full site takeover. According to the advisory, the exploitation is only possible if the “Host Files Locally – Gravatars” option is enabled. The issue affects Breeze Cache up to version 2.4.4 and is fixed in version 2.4.5.
Since the vulnerability is actively exploited, Breeze Cache users should update to the latest version immediately or disable the plugin temporarily.
At the time of this writing, Wordfence reported that it had blocked 3,936 attacks targeting this vulnerability in the past 24 hours.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Breeze Cache plugin)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/191267/uncategorized/over-400000-sites-at-risk-as-hackers-exploit-breeze-cache-plugin-flaw-cve-2026-3844.html