High severity · published May 9, 2024
CVE-2024-4605
Breakdance <= 1.7.1 - Authenticated (Contributor+) Remote Code Execution
8.8
CVSS
0.9%
EPSS
No
On KEV
Description
The Breakdance plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.7.1 via post meta data. This is due to the plugin storing custom data in metadata without an underscore prefix. This makes it possible for lower privileged users, such as contributors, to edit this data via UI. As a result they can escalate their privileges or execute arbitrary code.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BR
Breakdance · Breakdance
through 1.7.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-4605
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-4605
breakdance.com
https://breakdance.com/breakdance-1-7-2-now-available-security-update/
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/095b23b7-71ab-41eb-b666-73df2e1a7eb4?source=cve
More from Breakdance
7.2
CVE-2026-7543
Breakdance <= 2.7.1 - Unauthenticated Stored Cross-Site Scripting via Webhook Action Details
6.4
CVE-2023-6854
Breakdance <= 1.7.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom postmeta
5.4
CVE-2024-5330
Breakdance <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
4.3
CVE-2024-5331
Breakdance <= 1.7.2 - Missing Authorization