CVE-2026-83627
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
The Hummingbird plugin for WordPress (versions up to and including 3.21.0) is vulnerable to Remote Code Execution via the log_msg() function in class-page-cache.php. The protective '<?php die(); ?>' header is omitted due to a class_exists() namespace bug, and cookie names with the wphb_cache_ prefix are written to the log file without sanitization, allowing an unauthenticated attacker to write and execute arbitrary PHP.
Risk Assessment
An unauthenticated attacker can remotely execute arbitrary PHP code on the server, leading to full compromise of the WordPress site. This requires the non-default Page Caching with Debug Log option to be enabled.
Recommendation
Update the Hummingbird plugin to a version newer than 3.21.0, or if not possible, disable the Page Caching with Debug Log option and remove log files from the wp-content/wphb-logs/ directory.
Related vulnerabilities
- CVE-2026-78082Critical
The SP Property extension for Joomla (joomshaper.com) in versions below 4.1.4 contains an unauthenticated SQL Injection vulnerability. The property search and listing query builders (zipcode, sorting, price_range_dropdown, psize_range_dropdown) concatenate raw request parameters directly into SQL strings without quoting or type casting. A remote unauthenticated attacker can perform boolean-based or time-based blind SQL injection to extract sensitive data from the database.
- CVE-2026-8323Critical
The Access Control System by Armiya Information Technologies Ltd. Co. contains an open redirect vulnerability to an untrusted site. The issue affects versions before Versiyon 2 and allows faking the source of data.
- CVE-2026-88285Critical
The GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service without authentication. Remote clients can retrieve PTZ information and issue PTZ or raw serial commands.
- CVE-2026-88278Critical
The GeoVision GV-LPC2211 V1.13 fails to enforce WS-Security UsernameToken freshness or nonce reuse protection. A captured PasswordDigest token can be replayed for subsequent ONVIF operations.
- CVE-2026-59679Critical
In libXfont2's font-server client fs_read_glyphs() (src/fc/fserve.c), the per-character encoding[] array is indexed using num_chars from the FS_QueryXBitmaps16 reply, but that array was allocated with a size derived from num_extents in the separate FS_QueryXExtents16 reply. The two CARD32 fields are never cross-checked. A malicious or compromised font server can send a small num_extents (e.g. 1) followed by a large num_chars (e.g. 100000), causing attacker-controlled out-of-bounds heap reads and writes.
- CVE-2026-44950Critical
In libXfont2's font-server client fs_read_glyphs() (src/fc/fserve.c), each glyph's bitmap is copied into a single buffer, and existing checks only validate that the source slice (position, length) lies within the source bitmap buffer. They do not check whether the running destination cursor has exceeded the allocation. A malicious font server can send overlapping source offsets (e.g. 1000 glyphs each referencing {position:0, length:64} with nbytes=64), resulting in 64000 bytes written into a 64-byte destination buffer — a heap buffer overflow with attacker-controlled content.
- CVE-2026-13745Critical
A vulnerability in the Gemini CLI and associated GitHub Action allowed an unprivileged attacker to achieve arbitrary code execution in Gemini CLI via untrusted local .env files overriding GEMINI_CLI_HOME.
- CVE-2026-80352Critical
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K. A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges of the operator. This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2.
- CVE-2026-80351Critical
Improper neutralization of directives in dynamically evaluated code ('eval injection') vulnerability in Apache Camel K. An improper neutralization of directives in dynamically evaluated Maven configuration allows tenant-controlled repository content to influence code execution within the operator pod, potentially enabling tenants to execute arbitrary code with the privileges of the operator. This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2.
- CVE-2026-7188Critical
The Access Control System by Armiya Information Technologies Ltd. Co. contains an SQL injection vulnerability due to improper neutralization of special elements used in SQL commands. The issue affects versions before Versiyon 2.
Original NVD description (English source)
The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the log_msg() function in core/modules/class-page-cache.php. The page-cache debug log is written to wp-content/wphb-logs/page-caching-log.php, a directly web-accessible PHP file that is supposed to be protected by a leading '<?php die(); ?>' header. That header is guarded by class_exists( 'Filesystem' ), which can never match because class_exists() resolves string arguments in the global namespace while the class is Hummingbird\Core\Filesystem; when the log is created during a front-end request the header is therefore omitted entirely. get_cookies() then writes the raw name of any cookie matching the wphb_cache_ prefix into that file without sanitization. This makes it possible for unauthenticated attackers to write arbitrary PHP into the log file with a single anonymous request and execute it by requesting the file directly, resulting in full remote code execution. Exploitation requires the site administrator to have enabled Page Caching with the Debug Log option (non-default), and the log file to be created during a front-end request — a state reached by the plugin's own 'Clear logs' action, any cache flush, or unattended via the plugin's daily log-rotation cron, which can strip the protective header from an existing log file.