Hackers Exploit Critical File Upload Bug in Breeze Cache Plugin

Overview A critical vulnerability in the Breeze Cache WordPress plugin (CVE‑2026‑3844) is being actively exploited, allowing unauthenticated attackers to upload arbitrary files to servers. The flaw has already been leveraged in 170+ exploitation attempts, according to Wordfence telemetry, and poses a serious risk of remote code execution (RCE) and complete site takeover.

Key Highlights

• Plugin Impacted: Breeze Cache by Cloudways, with 400,000+ active installations.
• Severity: CVSS score 9.8/10 (Critical).
• Root Cause: Missing file‑type validation in the fetch_gravatar_from_remote function.
• Exploitation Condition: Attack possible only if the “Host Files Locally – Gravatars” add‑on is enabled (disabled by default).
• Affected Versions: All versions up to 2.4.4.
• Patch Released: Fixed in version 2.4.5 (April 2026).

Attack Mechanics

1. Attacker sends crafted requests exploiting the vulnerable function.
2. Arbitrary files are uploaded to the server without authentication.
3. Malicious payloads can be executed, leading to RCE.
4. Successful exploitation enables full website compromise.

Risks to Website Owners

• Complete Takeover: Attackers can gain full control of WordPress sites.
• Data Theft: Sensitive information stored in databases may be exfiltrated.
• Defacement & Malware Hosting: Sites may be defaced or used to distribute malware.
• SEO Poisoning: Compromised sites risk blacklisting by search engines.

Mitigation Guidance

• Upgrade Immediately: Update Breeze Cache to version 2.4.5.
• Disable Add‑on: If patching isn’t possible, disable the “Host Files Locally – Gravatars” feature.
• Monitor Logs: Check for unusual file uploads or unexpected PHP scripts.
• Apply WAF Rules: Use a Web Application Firewall to block suspicious requests.
• Backup & Recovery: Maintain secure backups to restore sites if compromised.

Final Thought

CVE‑2026‑3844 highlights how performance plugins can become high‑risk attack vectors when input validation is overlooked. With active exploitation already underway, site owners must patch immediately or disable vulnerable features to prevent RCE and full compromise.