CVE-2026-83627

Name of the Vulnerable Software and Affected Versions Hummingbird versions prior to 3.21.1

Description Remote Code Execution is possible via the log msg() function in core/modules/class-page-cache.php. The page-cache debug log is written to a web-accessible PHP file that fails to maintain a protective header due to an incorrect class exists() check for the HummingbirdCoreFilesystem class. Consequently, the get cookies() function writes the raw name of any cookie starting with the wphb cache prefix into the log file without sanitization. This allows unauthenticated attackers to inject and execute arbitrary PHP code by sending a request and then accessing the log file directly. This issue requires the Page Caching Debug Log option to be enabled and the log file to be generated during a front-end request, which can occur during cache flushes, the Clear logs action, or daily log-rotation cron tasks.

Recommendations Update to a version newer than 3.21.0. Disable the Page Caching Debug Log option to prevent the creation of the vulnerable log file.