CVE-2026-3844 CRITICAL

CVE-2026-3844: Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote

Vendor Cloudways
Product Breeze Cache
Weakness CWE-434 · Unrestricted file upload
Published April 23, 2026
Last update April 23, 2026
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability can only be exploited if "Host Files Locally - Gravatars" is enabled, which is disabled by default.

Explanation of Vulnerability in Simple Terms

02Summary

Breeze Cache versions 2.4.4 and earlier allow unauthenticated attackers to upload arbitrary files to the site without restriction. An attacker can upload malicious files—including PHP scripts—over the network with no authentication required. This enables remote code execution and full site compromise.

What an attacker can do

03Attacker Capabilities

Upload arbitrary files, including PHP scripts, to run code on the site.

Potential impact on your site

04Site Impact

Complete site compromise: attackers can execute code, steal data, modify content, or take the site offline.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

April 23, 2026 CVE published
April 23, 2026 Record updated