An unauthenticated remote code execution vulnerability in the Hummingbird Performance plugin for WordPress allows attackers to gain full control over affected websites.

This is a code injection vulnerability (CWE-94) occurring within the log_msg function. An unauthenticated attacker can inject arbitrary PHP code into a web-accessible debug log file by crafting specific cookies, which the plugin then executes when the log file is requested.

Successful exploitation results in full remote code execution, granting the attacker the ability to execute arbitrary commands on the underlying web server. This leads to complete site compromise, potential data theft, and the ability to pivot to other internal systems. Given the CVSS score of 9.8, this represents a critical risk to business continuity and data integrity.

Immediate Action: Update the Hummingbird Performance plugin to version 3.21.2 or higher immediately to apply the security patch. If an update is not immediately feasible, disable the Page Caching Debug Log feature.

Proactive Monitoring: Review server access logs for requests targeting /wp-content/wphb-logs/page-caching-log.php, especially those containing suspicious cookie strings or PHP syntax.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block requests containing malicious payloads in cookie headers or direct access attempts to the wphb-logs directory.

Public Exploit Available: Unknown

The severity of this vulnerability cannot be overstated, as it allows unauthenticated attackers to achieve full code execution. Administrators should prioritize updating the plugin to the latest version immediately. If the debug log feature was previously enabled, perform a forensic review of the log files to ensure no unauthorized code injection has already occurred.