/Vulnerability Library

Breeze <= 2.4.4 - Arbitrary File Upload

CVE-2026-3844
Verified

Description

Breeze Cache WordPress plugin <= 2.4.4 contains an unrestricted file upload vulnerability caused by missing file type validation in 'fetch_gravatar_from_remote' function, letting unauthenticated attackers upload arbitrary files, exploit requires 'Host Files Locally - Gravatars' enabled.

Severity

Critical

CVSS Score

9.8

Exploit Probability

4%

Published Date

April 23, 2026

Template Author

theamanrawat, ritikchaddha

CVE-2026-3844.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-3844
CWE ID:
cwe-434

References

https://patchstack.com/database/vulnerability/wordpress-breeze-cache-plugin-2-4-4-unauthenticated-arbitrary-file-upload-via-fetch-gravatar-from-remote-vulnerabilityhttps://nvd.nist.gov/vuln/detail/CVE-2026-3844

Remediation Steps

Update to the latest version where this vulnerability is fixed.