CVE-2024-31390CWE-94

WordPress Breakdance plugin <= 1.7.2 - Authenticated Remote Code Execution (RCE) vulnerability

Critical · published April 3, 2024

CVSS v3.1
9.9
EPSS
1%
Percentile
59.1
In the wild
Unconfirmed
What it is

🚨 A devastating code injection flaw in Soflyy Breakdance could allow an attacker to execute malicious code with just a single crafted input! 🔥 Think of it like a chef who blindly follows a recipe without checking the ingredients — if someone sneaks in a dangerous spice, the whole dish could turn toxic. This flaw lets attackers inject their own ingredients into the code, leading to potentially catastrophic results! An attacker could take complete control of your site, executing any code they wish — from stealing user data to crashing the entire application. The implications are absolutely devastating, especially for users relying on Breakdance for their website functionality!

Put simply

Think of it like a chef who blindly follows a recipe without checking the ingredients — if someone sneaks in a dangerous spice, the whole dish could turn toxic. This flaw lets attackers inject their own ingredients into the code, leading to potentially catastrophic results! This vulnerability stems from improper handling of code generation, allowing attackers to inject arbitrary code during the execution process. Affected versions include all prior to 1.7.2.

What to do

An attacker could take complete control of your site, executing any code they wish — from stealing user data to crashing the entire application. The implications are absolutely devastating, especially for users relying on Breakdance for their website functionality! Upgrade to Breakdance version 1.7.2 immediately to mitigate this risk. Additionally, conduct a security audit on all inputs to ensure no malicious code can be injected. Don't forget to implement input validation as a best practice! You've got this! By following these steps, you'll transform into a security hero and keep your site safe! 🛡️

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00895 · 59.1th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2024-04-03T11:39Z
EPSS history
Timeline
  • 03 APR 11:39Z
    WordPress Breakdance plugin <= 1.7.2 - Authenticated Remote Code Execution (RCE) vulnerability
    cvelistv5