CVE-2026-83627
Received Received - Intake

Remote Code Execution in Hummingbird WordPress Plugin

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: Wordfence

Description
The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the log_msg() function in core/modules/class-page-cache.php. The page-cache debug log is written to wp-content/wphb-logs/page-caching-log.php, a directly web-accessible PHP file that is supposed to be protected by a leading '<?php die(); ?>' header. That header is guarded by class_exists( 'Filesystem' ), which can never match because class_exists() resolves string arguments in the global namespace while the class is Hummingbird\Core\Filesystem; when the log is created during a front-end request the header is therefore omitted entirely. get_cookies() then writes the raw name of any cookie matching the wphb_cache_ prefix into that file without sanitization. This makes it possible for unauthenticated attackers to write arbitrary PHP into the log file with a single anonymous request and execute it by requesting the file directly, resulting in full remote code execution. Exploitation requires the site administrator to have enabled Page Caching with the Debug Log option (non-default), and the log file to be created during a front-end request — a state reached by the plugin's own 'Clear logs' action, any cache flush, or unattended via the plugin's daily log-rotation cron, which can strip the protective header from an existing log file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-83627
EUVD
EUVD-2026-71839

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_media the_hummingbird to 3.21.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Remote Code Execution flaw in the Hummingbird WordPress plugin up to version 3.21.0. It occurs because the plugin's debug log file lacks proper PHP protection headers. Attackers can exploit this by writing arbitrary PHP code into the log file via unprotected cookie values, then executing the code by accessing the file directly. Exploitation requires specific plugin settings like enabled Page Caching with Debug Log option.

Detection Guidance

Check for the existence of the log file at wp-content/wphb-logs/page-caching-log.php. If it exists and lacks the <?php die(); ?> header, the site may be vulnerable. Inspect the file for arbitrary PHP code or unusual cookie values with the wphb_cache_ prefix.

Impact Analysis

An attacker could gain full control of your WordPress site, allowing them to steal data, install malware, deface the site, or use it for further attacks. This requires minimal conditions: the plugin must be installed, Page Caching with Debug Log must be enabled, and the log file must be created during a front-end request.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face fines, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately update the Hummingbird plugin to a version beyond 3.21.0 if available. Disable Page Caching with Debug Log enabled. Remove any existing page-caching-log.php files. Ensure the plugin's log rotation cron does not strip protective headers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-83627. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart