The Breeze Cache plugin for WordPress contains a critical arbitrary file upload vulnerability in versions up to 2.4.4. The vulnerability exists in the 'fetch_gravatar_from_remote' function due to missing file type validation. Unauthenticated attackers can exploit this to upload arbitrary files to the server, potentially enabling remote code execution. The vulnerability requires the 'Host Files Locally - Gravatars' feature to be enabled, which is disabled by default. This represents a high-severity security risk for WordPress sites using the affected plugin versions.