Critical Vulnerability Discovered in Breeze Cache Plugin for WordPress
Hackers are currently exploiting a serious vulnerability in the Breeze Cache plugin for WordPress, enabling unauthorized file uploads to the server without requisite authentication.
This pressing security concern, designated as CVE-2026-3844, has already prompted over 170 exploitation attempts, as documented by the Wordfence security solution dedicated to safeguarding the WordPress ecosystem.
The Breeze Cache plugin, developed by Cloudways, boasts over 400,000 active installations. Its design aims to enhance website performance and loading speed through mechanisms such as caching, file optimization, and database maintenance, all intended to streamline page load times.
This vulnerability has garnered a critical severity score of 9.8 out of a possible 10. It was unearthed and reported by security researcher Hung Nguyen (also known as Bashu).
Investigators from the WordPress security firm Defiant, the creators of Wordfence, indicate that the issue arises from a lack of file-type validation within the ‘fetch_gravatar_from_remote’ function.
This deficiency permits an unauthenticated intruder to upload arbitrary files to the server, potentially culminating in remote code execution (RCE) and total website compromise.
However, successful exploitation hinges on the activation of the “Host Files Locally – Gravatars” add-on, which is not enabled by default, as the researchers have pointed out.
CVE-2026-3844 is applicable to all Breeze Cache iterations up to and including version 2.4.4. Cloudways has addressed this flaw in version 2.4.5, which was released earlier this week.
Current statistics from WordPress.org reveal that the plugin has seen approximately 138,000 downloads since the latest version debuted.
The extent of vulnerability among websites remains uncertain due to the absence of data regarding the number of installations with the “Host Files Locally – Gravatars” feature enabled.
Given the ongoing exploits, it is strongly urged that website owners and administrators relying on Breeze Cache for performance enhancement upgrade to the latest version of the plugin at their earliest convenience or, as a temporary measure, disable it.
If immediate upgrading is unfeasible, administrators should at least deactivate the “Host Files Locally – Gravatars” option.
Source link: Bleepingcomputer.com.
