CVE-2026-83627 - Exploits & Severity

The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0. The page-cache debug log is written to a directly web-accessible PHP file (wp-content/wphb-logs/page-caching-log.php) that is intended to be protected by a PHP die() header. However, due to a namespace resolution issue in the class_exists() check, this protective header is omitted when the log is created during front-end requests. The plugin's get_cookies() function writes raw cookie names matching the wphb_cache_ prefix into the log file without sanitization, allowing arbitrary PHP code to be written and executed.

An unauthenticated attacker over the network can inject arbitrary PHP code into the page-caching log file via a crafted cookie and execute it on the server by directly requesting the log file, resulting in full remote code execution with web server privileges. Exploitation requires the site administrator to have enabled Page Caching with the Debug Log option and the log file to exist or be created during a front-end request.

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Update the Hummingbird plugin to a version newer than 3.21.0. Alternatively, disable Page Caching Debug Log in the plugin settings if it is currently enabled. Ensure the wp-content/wphb-logs/ directory is properly protected from direct web access through web server configuration (.htaccess or nginx rules).

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Feedly found the first article mentioning CVE-2026-83627 . See article

NVD published the first details for CVE-2026-83627

A CVSS base score of 9.8 has been assigned.

The Hummingbird plugin for WordPress is critically vulnerable to remote code execution due to improper handling of debug logs, allowing unauthenticated attackers to write and execute arbitrary PHP code. Exploitation requires specific conditions, such as enabling Page Caching with Debug Log, but can be triggered through various actions, including cache flushes. There are no details on proof-of-concept exploits, mitigations, or patches provided in the article. See article

GitHub Advisories released a security advisory .

[GHSA-4rx5-c9jj-cfrj] The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for

CVE-2026-83627 - Critical CVE & PoC Archive

CVE-2026-83627 - Exploits & Severity - Feedly

CVE-2026-83627 - Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN CVE ID : CVE-2026-83627 Published : Sept. 5, 2026, 6:17 a.m. | 20 minutes ago Description : The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress i...

CVE-2026-83627 - Critical CVE & PoC Archive

[GHSA-4rx5-c9jj-cfrj] The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for

Be the first to know critical vulnerabilities

Collect, analyze, and vulnerability reports faster using AI