Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the log_msg() function in core/modules/class-page-cache.php. The page-cache debug log is written to wp-content/wphb-logs/page-caching-log.php, a directly web-accessible PHP file that is supposed to be protected by a leading '<?php die(); ?>' header. That header is guarded by class_exists( 'Filesystem' ), which can never match because class_exists() resolves string arguments in the global namespace while the class is Hummingbird\Core\Filesystem; when the log is created during a front-end request the header is therefore omitted entirely. get_cookies() then writes the raw name of any cookie matching the wphb_cache_ prefix into that file without sanitization. This makes it possible for unauthenticated attackers to write arbitrary PHP into the log file with a single anonymous request and execute it by requesting the file directly, resulting in full remote code execution. Exploitation requires the site administrator to have enabled Page Caching with the Debug Log option (non-default), and the log file to be created during a front-end request — a state reached by the plugin's own 'Clear logs' action, any cache flush, or unattended via the plugin's daily log-rotation cron, which can strip the protective header from an existing log file.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-05 | 1 | Disclosure1 |
| 2026-09-06 | 1 | Patch1 |
| 2026-09-07 | 3 | Disclosure1Patch1PoC1 |
| 2026-09-08 | 1 | Patch1 |
| 2026-09-11 | 1 | Patch1 |
| 2026-09-13 | 1 | Patch1 |
キャッシュ系プラグインHummingbird(7万サイト)にCVSS 9.8のRCE、CVE-2026-83627。原因は公開領域に置かれた.phpのデバッグログでした。3.21.2への更新と、ログ残骸・アクセス痕跡の点検手順をまとめました。
Post summary
The post describes a CVSS 9.8 RCE in the Hummingbird plugin, CVE-2026-83627, caused by publicly exposed .php debug logs. Its main actionable takeaway is updating to version 3.21.2 and checking logs/access traces, with no PoC, named exploit tool, or active exploitation claim.
🍪 Crafted cookie name = RCE. CVE-2026-83627 hits Hummingbird WordPress plugin (≤3.21.0) — unauthenticated attackers exploit log_msg() via page cache debug log. CVSS 9.8. Patch immediately. #cybersecurity #ciso #wordpress #vulnerabilities https://secalerts.co/vulnerability/CVE-2026-83627?utm_campaign=x https://t.co/ZrCKqPQ3qJ
Post summary
The tweet announces CVE‑2026‑83627, a high‑severity RCE in Hummingbird WordPress plugin, provides exploitation details, and urges users to patch immediately.
Gebruik je Hummingbird op WordPress? Update naar 3.21.2. Kritiek lek in de page cache debug log. Zet die log uit tot je geüpdatet hebt. https://www.cve.org/CVERecord?id=CVE-2026-83627 #wordpress #security #seo #ondernemen #denhaag
Post summary
The tweet alerts users of a CVE‑2026‑83627 in Hummingbird that leaks sensitive information through the debug log and recommends updating to version 3.21.2 to patch the flaw.
Si usas Hummingbird en WordPress (3.21.0 o menos) con el debug de caché prendido, actualiza a 3.21.2. Si no, pueden tomar el sitio sin login. https://www.wavys-technologies.com/es/blog/hummingbird-cve-2026-83627
Post summary
The post advises upgrading Hummingbird from 3.21.0 or lower, with cache debugging enabled, to version 3.21.2 to avoid potential site takeover without authentication.
🔒 #CyberSecurity CVE-2026-83627 and 4 Critical WordPress Plugin CVEs (CVSS 9.8): Unauthenticated… "In the last 72 hours, NVD published five CRITICAL-severity CVEs affecting WordPress…" 🔗 https://securityarsenal.com/blog/cve-2026-83627-and-4-critical-wordpress-plugin-cves-cvss-98-unauthenticated-code-execution-detection-and-remediation-guide #CyberSecurity #ThreatIntel #cve202683627 #critical #cve
Post summary
The text announces five newly published critical CVEs affecting WordPress plugins, highlights their severity and type, and references a remediation guide, indicating a disclosure with actionable mitigation advice.
🔐 🚨 Hummingbird WordPress Plugin — CVSS 9.8 CRITICAL CVE-2026-83627: Unauthenticated RCE via cookie injection → One crafted cookie writes PHP to debug log → https://threataft.com/articles/hummingbird-wordpress-cve-2026-83627-unauthenticated-rce #cybersecurity #infosec #WordPress #Hummingbird #RCE #CVSS9 #PatchNow #ThreatIntel
Post summary
The post announces a critical RCE flaw in the Hummingbird WordPress plugin, offers a crafted-cookie PoC and a link to an article, but lacks active exploitation evidence or patch details.
Hummingbird WordPress plugin versions up to 3.21.0 contain critical RCE (CVSS 9.8). Update immediately if in use. https://nvd.nist.gov/vuln/detail/CVE-2026-83627 via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/pAoYhs6VCe
Post summary
The tweet reports a critical RCE (CVSS 9.8) in Hummingbird WordPress plugin (CVE‑2026‑83627) and urges users to apply the pending patch immediately.
🆕👉 Hummingbird https://wpdeeply.com/hummingbird-3-21-0-unauthenticated-rce-page-cache-debug-log/ #loreleiweb CVE-2026-83627 is a newly published unauthenticated remote code execution vulnerability in Hummingbird Performance, the WPMU DEV caching and performance plugin for WordPress. The issue affects Hummingbird versions up to an… https://t.co/anux4Sz2Cg
Post summary
The tweet announces a newly discovered unauthenticated RCE vulnerability (CVE‑2026‑83627) in the Hummingbird Performance plugin, providing basic technical details but no PoC, exploit, patch, or evidence of active exploitation.