HUNGSEC CVD REGISTRY // OFFICIAL SECURITY ADVISORIES (2026)
RESEARCHER & FOUNDER: HUNG NGUYEN (NGUYEN THANH HUNG) · GITHUB @HUNG2124
HS
HungSec Labs Offensive Security Practice
COORDINATED VULNERABILITY DISCLOSURE ARCHIVE

Official Security Advisories

Technical root-cause analyses, CVSS v3.1 vector breakdowns, and upstream remediation diffs for vulnerabilities discovered and disclosed by Hung Nguyen (Nguyen Thanh Hung / Nguyen Hung), Founder & Principal Security Researcher at HungSec Labs (github.com/Hung2124).

HUNGSEC-2026-001 // CVE-2026-3844 CVSS 9.8 CRITICAL PATCHED UPSTREAM (v2.4.5)
PUBLISHED: 2026-04-23T02:25:21Z

WordPress Breeze Cache <= 2.4.4 — Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote()

Attack VectorNETWORK (AV:N)
ComplexityLOW (AC:L)
PrivilegesNONE (PR:N)
User InteractionNONE (UI:N)
ScopeUNCHANGED (S:U)
ConfidentialityHIGH (C:H)
IntegrityHIGH (I:H)
AvailabilityHIGH (A:H)
CVE Identifier & CNA CVE-2026-3844 · NVD Record · Assigned by Wordfence CNA (e342b1c0-6e7f-4e2c-8a52-018df12c12a0)
Credited Finder / Firm Hung Nguyen — Founder & Principal Security Researcher, HungSec Labs (github.com/Hung2124)
Affected Component Breeze WordPress Caching Plugin <= 2.4.4 · inc/class-breeze-cache-cronjobs.php (lines 89–119)
CWE Classification CWE-434: Unrestricted Upload of File with Dangerous Type

1. Vulnerability Overview & Root Cause

The Breeze Cache plugin for WordPress (versions up to and including 2.4.4) contains an unauthenticated arbitrary file upload vulnerability in the fetch_gravatar_from_remote() method inside inc/class-breeze-cache-cronjobs.php. When the "Host Files Locally - Gravatars" option is enabled, the plugin intercepts avatar URLs and downloads remote avatar resources to a publicly accessible cache directory on the server filesystem.

Because fetch_gravatar_from_remote() derived the local filename directly from the remote URL path without validating the file extension or verifying the HTTP response MIME content type via wp_check_filetype_and_ext(), an unauthenticated attacker can supply a crafted Gravatar URL pointing to a .php payload and achieve arbitrary code execution (RCE).

2. Vulnerable Code & Upstream Remediation Diff (Trac Changeset 3511463)

// File: inc/class-breeze-cache-cronjobs.php (Breeze <= 2.4.4 vs 2.4.5 Patch)
 private function fetch_gravatar_from_remote( $grav_url_id, $grav_Save_path ) {
     $response = wp_remote_get( $grav_url_id, array( 'timeout' => 15 ) );
     if ( is_wp_error( $response ) || 200 !== wp_remote_retrieve_response_code( $response ) ) {
         return false;
     }
     $body = wp_remote_retrieve_body( $response );
-    // VULNERABLE: Writes raw response body directly to $grav_Save_path without MIME or extension validation
-    breeze_read_write_file( $grav_Save_path, $body );
+    // FIXED (v2.4.5 - Changeset 3511463): Validate Content-Type & enforce strict image extension allow-list
+    $content_type = wp_remote_retrieve_header( $response, 'content-type' );
+    $allowed_mime = array( 'image/jpeg', 'image/png', 'image/gif', 'image/webp' );
+    if ( ! in_array( strtolower( $content_type ), $allowed_mime, true ) ) {
+        return false;
+    }
+    breeze_read_write_file( $grav_Save_path, $body );
 }

3. Disclosure & Patch Verification References

HUNGSEC-2026-002 // CVE-2026-11616 CVSS 8.8 HIGH PATCHED UPSTREAM (v2.3.29)
PUBLISHED: 2026-06-09T07:49:56Z

Events Calendar for GeoDirectory <= 2.3.28 — Authenticated (Subscriber+) Privilege Escalation via ajax_ayi_action()

Attack VectorNETWORK (AV:N)
ComplexityLOW (AC:L)
PrivilegesLOW (PR:L)
User InteractionNONE (UI:N)
ScopeUNCHANGED (S:U)
ConfidentialityHIGH (C:H)
IntegrityHIGH (I:H)
AvailabilityHIGH (A:H)
CVE Identifier & CNA CVE-2026-11616 · NVD Record · Assigned by Wordfence CNA (11ba187b-1fe4-4077-ad9d-a07660133e91)
Credited Finder / Firm Nguyen Hung (Hung Nguyen) — Founder & Principal Security Researcher, HungSec Labs (github.com/Hung2124)
Affected Component Events Calendar for GeoDirectory <= 2.3.28 · includes/class-geodir-event-ayi.php (lines 154, 357)
CWE Classification CWE-269: Improper Privilege Management / Arbitrary User-Meta Key Modification

1. Vulnerability Overview & Root Cause

In Events Calendar for GeoDirectory versions up to and including 2.3.28, the ajax_ayi_action() handler processes authenticated AJAX requests by applying only strip_tags(esc_sql())—without an allow-list—to the user-controlled $_POST['type'] and $_POST['postid'] parameters before forwarding them to update_ayi_data().

Inside update_ayi_data(), the plugin invokes update_user_meta($current_user->ID, $rsvp_args['type'], $posts) where $posts is an associative array keyed by $postid. By submitting type=wp_capabilities and postid=administrator, an authenticated user with Subscriber-level permissions overwrites their own wp_capabilities meta record with ['subscriber' => true, 'administrator' => 'administrator']. Because WP_User::get_role_caps() evaluates truthy array values for each role key, the attacker immediately gains full Administrator privileges on the next HTTP request.

2. Vulnerable Code & Upstream Remediation Diff (Trac Changeset 3533585)

// File: includes/class-geodir-event-ayi.php (GeoDirectory Events <= 2.3.28 vs 2.3.29 Patch)
 public static function ajax_ayi_action() {
     $type   = isset( $_POST['type'] ) ? strip_tags( esc_sql( $_POST['type'] ) ) : '';
     $postid = isset( $_POST['postid'] ) ? strip_tags( esc_sql( $_POST['postid'] ) ) : '';
-    // VULNERABLE: Forwards arbitrary $type directly to update_ayi_data() -> update_user_meta()
-    self::update_ayi_data( array( 'type' => $type, 'post_id' => $postid ) );
+    // FIXED (v2.3.29 - Changeset 3533585): Enforce strict allow-list on RSVP meta keys and cast post_id
+    $allowed_types = array( 'ayi_yes', 'ayi_maybe', 'ayi_invited' );
+    if ( ! in_array( $type, $allowed_types, true ) ) {
+        wp_send_json_error();
+    }
+    self::update_ayi_data( array( 'type' => $type, 'post_id' => absint( $postid ) ) );
 }

3. Disclosure & Patch Verification References