Critical Remote Code Execution Vulnerability in Hummingbird Performance Plugin for WordPress (CVE-2026-83627)
A critical vulnerability (CVE-2026-83627) with a CVSS score of 9.8 has been discovered in the Hummingbird Performance plugin for WordPress. This vulnerability allows unauthenticated attackers to execute arbitrary code on affected sites. The plugin, used for speed optimization, caching, minification, compression, and CDN integration, is vulnerable in all versions up to and including 3.21.0. Exploitation requires the site administrator to have enabled Page Caching with the Debug Log option. Immediate patching is recommended.