The Hummingbird Performance plugin for WordPress allows an unauthenticated attacker to inject arbitrary PHP code into the page‑caching debug log file. The vulnerability stems from the log_msg() function that writes the raw cookie name into a web‑accessible PHP file without sanitization, triggered when the debug log is enabled. Once the attacker writes malicious code into that file, executing the file via a web request yields full remote code execution. This flaw is a classic code injection vulnerability classified as CWE‑94.

This issue affects the Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin distributed by WPMU DEV. All versions up to and including 3.21.0 are vulnerable. WordPress sites that have enabled Page Caching with the Debug Log option, and where the log file has been created or rotated, are at risk.

The CVSS score of 9.8 categorizes the flaw as critical. The EPSS score is unavailable, so the likelihood of exploitation is uncertain; however, the KEV catalog does not list this vulnerability, suggesting limited documented exploitation. The exploitation chain requires the presence of the unhardened debug log file, which can be created by routine cache operations or the plugin’s daily log‑rotation script. Once conditions are met, an attacker can trigger remote code execution via a single anonymous HTTP request.