A critical vulnerability in the widely used Breeze Cache WordPress plugin, tracked as CVE-2026-3844 (CVSS 9.8/10), is under active exploitation, prompting urgent calls for website administrators to patch affected systems. Impacting Breeze Cache versions up to 2.4.4, the flaw stems from improper file-type validation in the plugin’s “fetch_gravatar_from_remote” function, allowing unauthenticated attackers to upload arbitrary files that could enable remote code execution (RCE) and complete website takeover. While exploitation requires the “Host Files Locally – Gravatars” feature to be enabled (a setting disabled by default) the risk remains significant given the plugin’s more than 400,000 active installations and uncertainty around how many sites have the feature active. Initially observed in over 170 exploitation attempts, threat activity has escalated sharply, with Wordfence reporting nearly 4,000 blocked attacks in a 24-hour period targeting the flaw. The vulnerability, discovered by researcher Hung Nguyen (bashu), was patched in Breeze Cache version 2.4.5, which has already seen significant adoption, though exposed and unpatched systems remain at risk. Given the combination of active exploitation, low attack complexity, and potential for full site compromise, CTIX analysts urge defenders to immediately upgrade to the latest version or, at minimum, disable the vulnerable Gravatar hosting functionality as a mitigation measure.