CVE-2026-3844 is a critical vulnerability in the Breeze Cache WordPress plugin caused by improper validation of file types in the 'fetch_gravatar_from_remote' function. This flaw permits unauthenticated attackers to upload arbitrary files to the server, potentially enabling remote code execution. The vulnerability is conditional on the 'Host Files Locally - Gravatars' feature being enabled, which is off by default. No official patch or remediation guidance has been provided yet, and no known exploits are reported in the wild.

Successful exploitation allows unauthenticated attackers to upload arbitrary files, which may lead to remote code execution on the affected server. This compromises the confidentiality, integrity, and availability of the affected system. The vulnerability is critical with a CVSS score of 9.8, reflecting its potential for severe damage if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to keep the 'Host Files Locally - Gravatars' setting disabled (default state) to prevent exploitation. Monitor vendor communications for updates and apply patches promptly once released.