Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote

This exploitation research plan details the steps required to achieve unauthenticated remote code execution (RCE) on a WordPress site running Breeze Cache <= 2.4.4.

1. Vulnerability Summary

The Breeze Cache plugin for WordPress is vulnerable to an unrestricted file upload in the fetch_gravatar_from_remote function. When the "Host Files Locally - Gravatars" setting is enabled, the plugin attempts to download Gravatar images to the local server to improve performance. However, it fails to validate the file extension or content of the remote file before saving it to a publicly accessible directory. An attacker can trigger this process by providing a URL that ends in .php (or another executable extension) in a context where an avatar is rendered, leading to arbitrary code execution.

2. Attack Vector Analysis

• Endpoint: Any page or action that renders a user avatar (e.g., viewing a post with comments, viewing an author's profile, or certain AJAX/REST endpoints).
• Vulnerable Function: fetch_gravatar_from_remote in inc/class-breeze-cache-cronjobs.php.
• Precondition: The setting breeze-store-gravatars-locally must be enabled.
• Authentication: None (Unauthenticated).
• Payload Location: The URL of the Gravatar image, which can be influenced via the get_avatar filter.

3. Code Flow

1. Entry Point: An unauthenticated user visits a page where WordPress renders an avatar