Executive brief
Hummingbird is a popular WordPress plugin for performance optimization through caching and minification. When the Page Caching debug log feature is enabled (non-default), attackers can inject and execute arbitrary PHP code by manipulating cookie values, allowing complete compromise of any WordPress site using the affected versions.
Technical details
The vulnerability is a remote code execution flaw in the log_msg() function within core/modules/class-page-cache.php. The page cache debug log is written to a web-accessible PHP file (wp-content/wphb-logs/page-caching-log.php) that should be protected by a leading '<?php die(); ?>' header; however, this protection is guarded by an incorrect class_exists() check that resolves to the global namespace instead of the Hummingbird\Core\Filesystem class, causing the header to be omitted when the log is created during front-end requests. The log_msg() function then writes unfiltered cookie names matching the wphb_cache_ prefix directly into the log file without sanitization. An unauthenticated attacker can craft a single anonymous request with a specially-named cookie to inject arbitrary PHP code into the log file and execute it by requesting the file directly. Exploitation requires Page Caching to be enabled with the Debug Log option active (non-default), though the log file can be created without authorization via cache flushes or the plugin's daily log-rotation cron. Patches are available in versions after 3.21.0.
Affected products
- WPML Hummingbird up to and including 3.21.0
Timeline
- 2026-09-05: disclosed