Critical RCE Flaw in Breeze Cache WordPress Plugin

The National Vulnerability Database reports a critical arbitrary file upload vulnerability, CVE-2026-3844, in the Breeze Cache plugin for WordPress. This flaw, present in all versions up to and including 2.4.4, stems from a lack of file type validation within the fetch_gravatar_from_remote function. This oversight enables unauthenticated attackers to upload arbitrary files to the server, a direct path to remote code execution (RCE).

While severe, exploitation is conditional. The vulnerability is only active if the “Host Files Locally - Gravatars” setting is enabled. Crucially, this setting is disabled by default, providing a small but significant hurdle for attackers. However, the CVSS score of 9.8 (CRITICAL) underscores the catastrophic impact if an attacker can bypass this default configuration, or if administrators have intentionally enabled the feature.

For defenders, this means a straightforward but critical check. If you’re running Breeze Cache, verify the status of the “Host Files Locally - Gravatars” option. An attacker’s calculus here is simple: find misconfigured instances where this feature is active, then exploit the arbitrary file upload to gain RCE. This is a high-reward target for any unauthenticated attacker scanning for vulnerable WordPress sites.