CVE-2026-3844

This flaw lets a stranger add files to your website’s server, as if they could drop anything they want into your website storage. If the wrong feature is enabled (“Host Files Locally - Gravatars”), those uploaded files could be used to take over the site or execute commands on the server. Think of it like an unlocked side door: most buildings are fine, but if the door is actually left unlocked, someone can get in.

This matters if you run the WordPress plugin “Breeze Cache” at version 2.4.4 or earlier. The risk is specifically tied to whether “Host Files Locally - Gravatars” is enabled, which is disabled by default, so many sites won’t be reachable from outside unless that feature is turned on. Reachability gate: only a risk if the vulnerable plugin version is installed AND “Host Files Locally - Gravatars” is enabled.

This is RED because attackers can upload files without logging in if a specific Breeze Cache feature is enabled. Press attention indicates active interest and potential targeting, and the overall risk likelihood is rising. Even though the default configuration is safer, you should check your setting and disable it immediately if you’re in an affected configuration.