Vulnerability · Published May 9, 2024 · Assigned by Wordfence
CVE-2024-4605Breakdance <= 1.7.1 - Authenticated (Contributor+) Remote Code Execution
High 8.8
In plain English
A high-severity code injection in Breakdance from Breakdance. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).
Official description
The Breakdance plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.7.1 via post meta data. This is due to the plugin storing custom data in metadata without an underscore prefix. This makes it possible for lower privileged users, such as contributors, to edit this data via UI. As a result they can escalate their privileges or execute arbitrary code.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Breakdance | Breakdance | 0 – through 1.7.1 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H