Critical Arbitrary File Upload Vulnerability in Breeze Cache Plugin (CVE-2026-3844)

On April 22, 2026 the Breeze Cache WordPress plugin (up to version 2.4.4) was publicly disclosed to have a critical arbitrary file upload flaw (CVE‑2026‑3844) that allows unauthenticated attackers to upload any file, including PHP backdoors, via the fetch_gravatar_from_remote function. The flaw is triggered only when the "Host Files Locally – Gravatars" option is enabled, a setting that is disabled by default, and exploits the plugin’s incorrect regular expression that also matches the alt attribute of avatar <img> tags. Attackers can inject a malicious URL into a comment’s author name, causing the plugin to download the file to the publicly accessible /wp‑content/cache/breeze‑extra/gravatars/ directory without file‑type validation, enabling remote code execution.

The vendor released the patched version 2.4.5 on April 21, 2026, and Wordfence already deployed firewall rules on March 10, 2026 for premium users and on April 10, 2026 for free users, blocking over 30,000 exploit attempts. With an estimated 400,000 active installations, the vulnerability is being actively exploited and poses a severe risk to all WordPress sites using Breeze Cache.

Immediate action is required: update to Breeze Cache 2.4.5 and verify that the gravatar caching feature is disabled or that the plugin is fully patched to prevent remote code execution.