Is CVE-2026-83627 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-83627 being exploited in the wild.

How severe is CVE-2026-83627?

Critical severity, with a CVSS score of 9.8, published 5 September 2026.

Which products and versions are affected?

WPML Hummingbird up to and including 3.21.0.

Is there a fix for CVE-2026-83627?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-83627 attacked?

It is attacked over the network.

Am I affected by CVE-2026-83627?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-83627: WordPress Hummingbird remote code execution in page cache debug log

CVE-2026-83627 · Severity: critical · CVSS 9.8 · Published 2026-09-05

Hummingbird is a popular WordPress plugin for performance optimization through caching and minification. When the Page Caching debug log feature is enabled (non-default), attackers can inject and execute arbitrary PHP code by manipulating cookie values, allowing complete compromise of any WordPress site using the affected versions.

Quick answers

Is CVE-2026-83627 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-83627 being exploited in the wild.
How severe is CVE-2026-83627?: Critical severity, with a CVSS score of 9.8, published 5 September 2026.
Which products and versions are affected?: WPML Hummingbird up to and including 3.21.0.
Is there a fix for CVE-2026-83627?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-83627 attacked?: It is attacked over the network.
Am I affected by CVE-2026-83627?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a remote code execution flaw in the log_msg() function within core/modules/class-page-cache.php. The page cache debug log is written to a web-accessible PHP file (wp-content/wphb-logs/page-caching-log.php) that should be protected by a leading '<?php die(); ?>' header; however, this protection is guarded by an incorrect class_exists() check that resolves to the global namespace instead of the Hummingbird\Core\Filesystem class, causing the header to be omitted when the log is created during front-end requests. The log_msg() function then writes unfiltered cookie names matching the wphb_cache_ prefix directly into the log file without sanitization. An unauthenticated attacker can craft a single anonymous request with a specially-named cookie to inject arbitrary PHP code into the log file and execute it by requesting the file directly. Exploitation requires Page Caching to be enabled with the Debug Log option active (non-default), though the log file can be created without authorization via cache flushes or the plugin's daily log-rotation cron. Patches are available in versions after 3.21.0.

Affected products

WPML Hummingbird up to and including 3.21.0

Timeline

2026-09-05: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.