CVE-2024-4605highCWE-94

CVE-2024-4605: fallo de gravedad alta en Breakdance

Breakdance <= 1.7.1 - Authenticated (Contributor+) Remote Code Execution

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Breakdance

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.8epss 0.9%
The Breakdance plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.7.1 via post meta data. This is due to the plugin storing custom data in metadata without an underscore prefix. This makes it possible for lower privileged users, such as contributors, to edit this data via UI. As a result they can escalate their privileges or execute arbitrary code.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Breakdance · Breakdance
CVEs relacionadas — Breakdance

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-6854MEDIUMBreakdance <= 1.7.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom postmetaEPSS 0.3%CVE-2026-7543HIGHBreakdance <= 2.7.1 - Unauthenticated Stored Cross-Site Scripting via Webhook Action DetailsEPSS 0.3%CVE-2024-5330MEDIUMBreakdance <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-5331MEDIUMBreakdance <= 1.7.2 - Missing AuthorizationEPSS 0.2%