What is the CVSS score of CVE-2026-65551?

CVE-2026-65551 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Breakdance are affected by CVE-2026-65551?

Breakdance WordPress page builder (versions before 2.7) contains authorization flaws that allow unauthenticated attackers to access protected administrative functionality and extract sensitive data…. A patch is available.

How to fix or mitigate CVE-2026-65551?

Within 24 hours: Conduct an inventory of all WordPress installations to identify those running Breakdance versions prior to 2.7; prioritize assessment of sites hosting sensitive data or administrative content. Within 7 days: Deploy temporary access controls via Web Application Firewall (WAF) rules or network-level firewalls to restrict unauthenticated access to Breakdance-protected functionality; contact Breakdance vendor support for interim guidance or undocumented workarounds. Within 30 days: Monitor Breakdance security advisories and the vendor's GitHub repository for patch release (version 2.7 or later); once available, test the patch in a staging environment and deploy to production systems within 14 days.

Breakdance CVE-2026-65551

EUVD-2026-53874 HIGH

Missing Authorization (CWE-862)

2026-08-06 audit@patchstack.com

GHSA-m9x3-r332-8q72

WordPress Authentication Bypass Wordpress Plugin

7.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Endpoint is network-accessible with no credentials required per CWE-862 missing auth pattern; only confidentiality is impacted with no integrity or availability effects described.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Aug 06, 2026 - 14:01 EUVD

Analysis Generated

Aug 06, 2026 - 13:32 vuln.today

CVE Published

Aug 06, 2026 - 13:18 cve.org

HIGH 7.5

DescriptionCVE.org

Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Breakdance: from n/a before 2.7.

AnalysisAI

Missing authorization checks in the Breakdance WordPress page builder plugin (all versions before 2.7) allow unauthenticated remote attackers to access protected functionality due to improperly configured access control levels. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms network-reachable exploitation with no credentials required and high confidentiality impact, meaning sensitive data accessible only to authenticated users can be read by anonymous attackers. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Breakdance is a visual WordPress page builder plugin developed by Soflyy. The root cause is CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before granting access to one or more protected operations or data endpoints. In WordPress plugin architecture, this typically occurs when REST API routes, admin-ajax handlers, or admin-menu callbacks omit capability checks such as current_user_can() or nonce verification, allowing unauthenticated HTTP requests to reach privileged functionality. The Patchstack advisory references version 2.6.1 as the confirmed vulnerable release, with the fix shipped in version 2.7.

RemediationAI

Update the Breakdance plugin to version 2.7 or later immediately via the WordPress plugin dashboard or by downloading directly from the WordPress plugin repository; this is the vendor-released patch confirmed by the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/breakdance/vulnerability/wordpress-breakdance-plugin-2-6-1-broken-access-control-vulnerability. As an interim compensating control, administrators unable to patch immediately should restrict access to WordPress REST API and admin-ajax endpoints via a web application firewall (WAF) - for example, applying IP allowlist rules to /wp-json/ and /wp-admin/admin-ajax.php - though this may break legitimate front-end functionality that depends on these endpoints and is not a substitute for patching. Deactivating the Breakdance plugin entirely until patching is feasible eliminates the attack surface at the cost of losing page builder functionality.