A namespace bug in the Hummingbird performance plugin strips the protective header from its web-accessible debug log, letting unauthenticated attackers write and execute arbitrary PHP on affected WordPress sites.
What Is It
CVE-2026-83627 is a critical remote code execution flaw (CWE-94, CVSS 3.1 base score 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in the log_msg() function of core/modules/class-page-cache.php.
The page-cache debug log is written to wp-content/wphb-logs/page-caching-log.php, a directly web-accessible PHP file that is meant to be neutralized by a leading <?php die(); ?> header. That header is written behind a class_exists( 'Filesystem' ) guard, which can never evaluate true: class_exists() resolves string arguments in the global namespace, while the actual class is Hummingbird\Core\Filesystem. When the log is created during a front-end request, the header is omitted entirely.
From there, get_cookies() writes the raw name of any cookie matching the wphb_cache_ prefix into the file without sanitization. An attacker supplies PHP code as a cookie name in a single anonymous request, then executes it by requesting the log file directly.
Why It Matters
Exploitation requires no authentication, no user interaction, and low attack complexity; one anonymous HTTP request plus one direct file fetch yields full code execution on the host. The result is complete compromise of confidentiality, integrity, and availability.
Two caveats bound real-world exposure. The site administrator must have enabled Page Caching with the Debug Log option, which is not the default. The log file must also be created during a front-end request; a state reached via the plugin's own "Clear logs" action, any cache flush, or unattended through the plugin's daily log-rotation cron, which can strip the protective header from an already-existing log file.
No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation in the supplied source material.
What's Vulnerable
- Vendor: wpmudev
- Product: Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress
- Affected versions: all versions up to and including 3.21.0 are confirmed vulnerable by the supplied advisory data. Because the fix is only evidenced in 3.21.2, the supplied material does not establish whether the intermediate release 3.21.1 contains the patch; it should be treated as vulnerable until the vendor states otherwise.
Patch Status
The supplied references point to changeset 3675836 and a diff spanning tags 3.20.0 to 3.21.2, indicating the fix landed in 3.21.2. Administrators should update Hummingbird to 3.21.2 or later; sites running 3.21.1 should not be assumed patched. No KEV-mandated remediation deadline was supplied.