PT-2024-31890 · WordPress · Breakdance

Francesco Carlucci · Published 2024-05-09 · Updated 2024-05-14 · CVE-2024-4605

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Breakdance plugin for WordPress versions up to and including 1.7.1

Description The issue allows for Remote Code Execution via post meta data. This is due to the plugin storing custom data in metadata without an underscore prefix, making it possible for lower privileged users to edit this data and escalate their privileges or execute arbitrary code.

Recommendations For Breakdance plugin for WordPress versions up to and including 1.7.1, update to a version higher than 1.7.1 to resolve the issue. As a temporary workaround, consider restricting access to the post meta data editing functionality to prevent lower privileged users from exploiting this issue.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-4605

Affected Products

Breakdance

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-4605 · Security Note
• https://breakdance.com/breakdance-1-7-2-now-available-security-update · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/095b23b7-71ab-41eb-b666-73df2e1a7eb4?source=cve · Note