Breakdance <= 1.7.1 - Authenticated (Contributor+) Remote Code Execution

CVE-2024-4605

What is CVE-2024-4605?

The Breakdance plugin for WordPress suffers from a vulnerability that allows Remote Code Execution due to improper handling of post meta data. Versions up to 1.7.1 are impacted as the plugin stores custom data in metadata without the necessary underscore prefix. This design flaw permits lower-privileged users, such as contributors, to modify sensitive data through the user interface, potentially allowing them to escalate their privileges and execute arbitrary code on the server. Website administrators using the Breakdance plugin are advised to update to version 1.7.2 or later to mitigate this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References