CVE-2024-4605 Breakdance <= 1.7.1 - Authenticated (Contributor+) Remote Code Execution
Authenticated contributors can execute arbitrary code or escalate privileges in the Breakdance WordPress plugin due to insecure metadata storage.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-4605?
CVE-2024-4605 is a high-severity code injection vulnerability in Breakdance, published on 9 May 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Breakdance plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.7.1 via post meta data. This is due to the plugin storing custom data in metadata without an underscore prefix. This makes it possible for lower privileged users, such as contributors, to edit this data via UI. As a result they can escalate their privileges or execute arbitrary code.
Weakness: CWE-94
Which versions are affected by CVE-2024-4605?
How do I fix CVE-2024-4605?
No fix has been published for CVE-2024-4605 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-4605 being exploited?
There is no known exploitation of CVE-2024-4605 in the wild and no public exploit code.
Sources
Also known as GHSA-j5mg-7pph-vc9m.