CVE-2026-3844
Published: 23 April 2026
Summary
CVE-2026-3844 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 1.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the fetch_gravatar_from_remote function across all versions through 2.4.4. The flaw, tracked as CWE-434, permits unauthenticated attackers to place arbitrary files on the server, which can enable remote code execution when the non-default "Host Files Locally - Gravatars" setting is enabled. The issue carries a CVSS 3.1 score of 9.8.
Unauthenticated remote attackers can exploit the vulnerability over the network without user interaction or credentials whenever the Gravatars hosting option is active. Successful exploitation allows upload of malicious files that may be executed on the web server, leading to full compromise of the affected site.
The linked WordPress plugin trac changesets and Wordfence advisory document the corrective code changes that address the missing validation, indicating that site administrators should apply the available plugin update to resolve the issue. The EPSS score has remained flat at its peak value of 0.2935 with no material upward trajectory observed after disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25174
Vulnerability details
The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to upload arbitrary…
more
files on the affected site's server which may make remote code execution possible. The vulnerability can only be exploited if "Host Files Locally - Gravatars" is enabled, which is disabled by default.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload vulnerability in public-facing WordPress plugin enables exploitation of public-facing application (T1190) and facilitates uploading web shells for RCE (T1100).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of input data (file type/content) before processing uploads in fetch_gravatar_from_remote, blocking the arbitrary file upload vector.
Enforces malicious-code scanning and blocking mechanisms that would detect and stop execution of uploaded files when the Gravatars hosting option is enabled.
Mandates timely application of the plugin patch that adds the missing file-type validation, eliminating the CWE-434 flaw before exploitation.