[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZYSa7URTD2quvvjEGYK7RnjiV9ecThdCtyjXkIOldUs":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":26,"research_verified":27,"research_rounds_completed":28,"research_plan":29,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":30,"research_started_at":31,"research_completed_at":32,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":27,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":27,"source_links":33},"CVE-2026-3844","breeze-cache-unauthenticated-arbitrary-file-upload-via-fetchgravatarfromremote","Breeze Cache \u003C= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote","The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability can only be exploited if \"Host Files Locally - Gravatars\" is enabled, which is disabled by default.","breeze",null,"\u003C=2.4.4","2.4.5","critical",9.8,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H","Unrestricted Upload of File with Dangerous Type","2026-04-22 13:59:41","2026-04-23 02:25:21",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fe342b1c0-6e7f-4e2c-8a52-018df12c12a0?source=api-prod",1,[22,23,24,25],"breeze.php","changelog.txt","inc\u002Fclass-breeze-cache-cronjobs.php","readme.txt","researched",false,3,"This exploitation research plan details the steps required to achieve unauthenticated remote code execution (RCE) on a WordPress site running Breeze Cache \u003C= 2.4.4.\n\n### 1. Vulnerability Summary\nThe Breeze Cache plugin for WordPress is vulnerable to an unrestricted file upload in the `fetch_gravatar_from_remote` function. When the \"Host Files Locally - Gravatars\" setting is enabled, the plugin attempts to download Gravatar images to the local server to improve performance. However, it fails to validate the file extension or content of the remote file before saving it to a publicly accessible directory. An attacker can trigger this process by providing a URL that ends in `.php` (or another executable extension) in a context where an avatar is rendered, leading to arbitrary code execution.\n\n### 2. Attack Vector Analysis\n- **Endpoint:** Any page or action that renders a user avatar (e.g., viewing a post with comments, viewing an author's profile, or certain AJAX\u002FREST endpoints).\n- **Vulnerable Function:** `fetch_gravatar_from_remote` in `inc\u002Fclass-breeze-cache-cronjobs.php`.\n- **Precondition:** The setting `breeze-store-gravatars-locally` must be enabled.\n- **Authentication:** None (Unauthenticated).\n- **Payload Location:** The URL of the Gravatar image, which can be influenced via the `get_avatar` filter.\n\n### 3. Code Flow\n1.  **Entry Point:** An unauthenticated user visits a page where WordPress renders an avatar","gemini-3-flash-preview","2026-04-27 13:43:47","2026-04-27 13:44:42",{"type":34,"vulnerable_version":35,"fixed_version":11,"vulnerable_browse":36,"vulnerable_zip":37,"fixed_browse":38,"fixed_zip":39,"all_tags":40},"plugin","2.4.4","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fbreeze\u002Ftags\u002F2.4.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fbreeze.2.4.4.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fbreeze\u002Ftags\u002F2.4.5","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fbreeze.2.4.5.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fbreeze\u002Ftags"]