CVE-2024-4605
Breakdance <= 1.7.1 - Authenticated (Contributor+) Remote Code Execution
Vexday Risk Score
21Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 8.8EPSS 0.9%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
09 may 2024Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
The Breakdance plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.7.1 via post meta data. This is due to the plugin storing custom data in metadata without an underscore prefix. This makes it possible for lower privileged users, such as contributors, to edit this data via UI. As a result they can escalate their privileges or execute arbitrary code.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Breakdance · Breakdance¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →