CVE-2026-3844 is a critical vulnerability in the Breeze Cache WordPress plugin caused by CWE-434: Unrestricted Upload of File with Dangerous Type. The issue arises from the lack of file type validation in the 'fetch_gravatar_from_remote' function, allowing unauthenticated attackers to upload arbitrary files to the server. This can potentially lead to remote code execution on affected sites. The vulnerability is present in all versions up to 2.4.4 and requires the 'Host Files Locally - Gravatars' option to be enabled for exploitation. The CVSS 3.1 base score is 9.8, indicating a critical severity level. No patch or official remediation has been disclosed as of the publication date.

Successful exploitation allows unauthenticated attackers to upload arbitrary files to the affected server, potentially leading to remote code execution, complete site compromise, and disruption of availability. The high CVSS score (9.8) reflects the critical nature of this vulnerability with network attack vector, no privileges or user interaction required, and full confidentiality, integrity, and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to keep the 'Host Files Locally - Gravatars' feature disabled (default setting) to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.