Breakdance <= 1.7.1 - Authenticated (Contributor+) Remote Code Execution

CVE-2024-4605

Summary

The Breakdance plugin for WordPress suffers from a vulnerability that allows Remote Code Execution due to improper handling of post meta data. Versions up to 1.7.1 are impacted as the plugin stores custom data in metadata without the necessary underscore prefix. This design flaw permits lower-privileged users, such as contributors, to modify sensitive data through the user interface, potentially allowing them to escalate their privileges and execute arbitrary code on the server. Website administrators using the Breakdance plugin are advised to update to version 1.7.2 or later to mitigate this vulnerability.

References