CVE-2026-83627: CWE-94 Improper Control of Generation of Code ('Code Injection') in wpmudev Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN
Description
The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the log_msg() function in core/modules/class-page-cache.php. The page-cache debug log is written to wp-content/wphb-logs/page-caching-log.php, a directly web-accessible PHP file that is supposed to be protected by a leading '<?php die(); ?>' header. That header is guarded by class_exists( 'Filesystem' ), which can never match because class_exists() resolves string arguments in the global namespace while the class is Hummingbird\Core\Filesystem; when the log is created during a front-end request the header is therefore omitted entirely. get_cookies() then writes the raw name of any cookie matching the wphb_cache_ prefix into that file without sanitization. This makes it possible for unauthenticated attackers to write arbitrary PHP into the log file with a single anonymous request and execute it by requesting the file directly, resulting in full remote code execution. Exploitation requires the site administrator to have enabled Page Caching with the Debug Log option (non-default), and the log file to be created during a front-end request — a state reached by the plugin's own 'Clear logs' action, any cache flush, or unattended via the plugin's daily log-rotation cron, which can strip the protective header from an existing log file.
CVSS v3.1
Score 9.8critical
Affected software
wpmudev
Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-83627 is a critical remote code execution vulnerability in the Hummingbird Performance – Cache & Page Speed Optimization WordPress plugin, affecting all versions up to and including 3.21.0. The issue stems from the log_msg() function in core/modules/class-page-cache.php, which writes debug logs to a PHP file (wp-content/wphb-logs/page-caching-log.php) intended to be protected by a die() header. However, this header is conditionally added based on a class_exists() check that fails due to namespace resolution issues, resulting in the header being omitted during front-end requests. Consequently, raw cookie names with the wphb_cache_ prefix are written unsanitized into the log file, enabling unauthenticated attackers to inject arbitrary PHP code. Execution occurs when the attacker requests the log file directly. The vulnerability requires the site administrator to have enabled Page Caching with Debug Log (a non-default setting) and for the log file to be created during front-end requests, which can happen via plugin actions or scheduled log rotation.
Potential Impact
Successful exploitation allows unauthenticated remote attackers to execute arbitrary PHP code on the affected WordPress site, leading to full system compromise. This can result in complete control over the server, data theft, site defacement, or further attacks. The vulnerability is critical due to its ease of exploitation (no authentication or user interaction required) and the high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
No official patch or fix is currently confirmed. Administrators should immediately disable the Page Caching Debug Log option in the Hummingbird plugin to prevent log file creation without the protective header. Avoid enabling debug logging in production environments until a vendor-provided fix is available. Monitor the vendor advisory for updates and apply official patches once released. Restrict web access to the wp-content/wphb-logs directory as a temporary measure to prevent direct access to the log file.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-08-31T21:02:35.689Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a9baaa6acd9273b49623807
Added to database: 09/05/2026, 05:37:42 UTC
Last enriched: 09/07/2026, 11:26:22 UTC
Last updated: 10/20/2026, 06:48:19 UTC
Views: 134
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.