Security researchers have identified active exploitation of a critical vulnerability in the Breeze Cache WordPress plugin. The flaw allows attackers to upload arbitrary files without authentication, potentially compromising websites running the popular performance optimization tool.

The vulnerability, designated CVE-2026-3844, has already triggered over 170 exploitation attempts detected by Wordfence security systems. Cloudways, the developer of Breeze Cache, released a security patch this week to address the issue.

Critical Flaw Affects Hundreds of Thousands of Sites

Breeze Cache serves more than 400,000 active WordPress installations globally. The plugin enhances website performance through caching mechanisms, file optimization, and database cleanup features. However, this widespread adoption makes the security vulnerability particularly concerning for website administrators.

Security researcher Hung Nguyen, known as bashu, discovered and reported the flaw. The vulnerability earned a critical severity rating of 9.8 out of 10 on the CVSS scale. This high score reflects the serious nature of the security gap and its potential impact.

How the Vulnerability Works

The security flaw originates from inadequate file-type validation in the plugin’s ‘fetch_gravatar_from_remote’ function. Researchers at Defiant, the company behind Wordfence, explained that this oversight creates a dangerous opportunity for attackers. Unauthenticated users can exploit this weakness to upload malicious files directly to the server.

Successful exploitation enables remote code execution, which can lead to complete website takeover. Attackers could potentially steal data, inject malicious content, or use compromised sites for further attacks. However, exploitation requires one specific condition to be met.

Exploitation Requires Specific Configuration

The vulnerability only affects sites with the “Host Files Locally – Gravatars” add-on enabled. This feature is not activated by default, which limits the number of vulnerable installations. Nevertheless, administrators who enabled this functionality face immediate risk from active attacks.

CVE-2026-3844 impacts all Breeze Cache versions up to and including 2.4.4. Cloudways addressed the security gap in version 2.4.5, which became available earlier this week. Website owners should prioritize updating to this patched version.

WordPress.org statistics show approximately 138,000 downloads since the security update launched. The exact number of vulnerable sites remains unknown because data on Gravatar hosting activation rates is unavailable. This uncertainty makes widespread updating even more critical.

Immediate Action Required for Site Security

Website administrators using Breeze Cache should take immediate action to protect their sites. The primary recommendation is upgrading to version 2.4.5 as soon as possible. This update eliminates the vulnerability and blocks exploitation attempts.

For administrators unable to update immediately, temporary measures exist. Disabling the Breeze Cache plugin entirely removes the attack vector until updating becomes feasible. Alternatively, turning off the “Host Files Locally – Gravatars” feature specifically addresses the vulnerability while maintaining other plugin functionality.

WordPress Security Best Practices

This incident highlights broader WordPress security considerations. Regular plugin updates remain essential for maintaining site security. Additionally, administrators should carefully evaluate which optional features they enable, as these can introduce unexpected vulnerabilities.

Security monitoring tools like Wordfence provide valuable early warning systems. These solutions help detect exploitation attempts before attackers can cause significant damage. Website owners should consider implementing comprehensive security solutions alongside timely updates.

The Breeze Cache vulnerability demonstrates how even popular, well-maintained plugins can harbor critical security flaws. Therefore, website administrators must stay vigilant about security updates and follow vendor recommendations promptly. Taking swift action protects both site integrity and visitor data.

Original Source: www.bleepingcomputer.com