CVE-2026-65551
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdance: from n/a before 2.7.
Risk Assessment
An attacker may gain unauthorized access to administrative functions or data, potentially leading to compromise of system integrity and confidentiality.
Recommendation
It is recommended to update the Breakdance plugin to version 2.7 or later, which includes the fix. Also review access control configuration to ensure permission levels are correctly set.
Other vulnerabilities in Breakdance
See all- CVE-2026-57735High
The Breakdance plugin version 2.7.1 and earlier contains a Cross Site Scripting (XSS) vulnerability without requiring authentication. An attacker can inject malicious JavaScript code into the page.
- CVE-2026-7543High
The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields' parameter in versions up to and including 2.7.1 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.
Original NVD description (English source)
Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdance: from n/a before 2.7.