CVE-2026-65551

Executive Summary

CVE-2026-65551 is a Missing Authorization vulnerability (CWE-862) in the Soflyy Breakdance plugin for WordPress, affecting all versions prior to 2.7. The flaw allows a remote, unauthenticated attacker to exploit incorrectly configured access control security levels, resulting in a High severity (CVSS 7.5) information disclosure with no user interaction required. Due to the unauthenticated network-based attack vector and the widespread use of the Breakdance page builder plugin, this vulnerability poses a significant information disclosure risk to any WordPress deployment running an affected version.

Technical Analysis

The vulnerability is categorized under CWE-862 (Missing Authorization), indicating that the software does not perform an access control check or performs an incorrect access control check at a specific point in the codebase. In the context of the Breakdance plugin, version 2.7 and earlier versions are affected, with the patch introduced in version 2.7.

The attack mechanism is rooted in the plugin's failure to properly verify user permissions or authentication tokens before exposing certain functionality or resources. When a WordPress site runs the Breakdance plugin below version 2.7, unauthenticated requests to specific endpoints or functions within the plugin are processed without the necessary authorization checks. This results in the disclosure of sensitive information (confidentiality impact rated as High in the CVSS vector) while maintaining no impact to integrity or availability.

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms the following characteristics:

• Attack Vector: Network — The vulnerability is exploitable remotely via the network.
• Attack Complexity: Low — No special conditions or sophisticated techniques are required to exploit the flaw.
• Privileges Required: None — No authentication is needed to trigger the vulnerability.
• User Interaction: None — The attacker does not require the victim to perform any action.
• Scope: Unchanged — The compromise is confined to the vulnerable component.
• Confidentiality: High — Significant information disclosure is possible.
• Integrity: None — No data modification capability is granted.
• Availability: None — No denial-of-service impact.

The attack surface is the WordPress web interface itself, where the Breakdance plugin registers its hooks, REST endpoints, and AJAX actions. The vulnerability arises from the plugin failing to check for current_user_can() or similar authorization capabilities on certain callback functions, allowing unauthenticated access to data that should be restricted.

Exploitation Scenarios

Step 1: Reconnaissance and Target Identification

An attacker begins by scanning the internet for WordPress sites running the Breakdance plugin. This can be done using search engines like Google Dorking (e.g., searching for page source code containing breakdance identifiers), the PublicWWW service, or by leveraging Shodan with the dork http.title:"Breakdance" or http.component:"WordPress". WordPress sites with the plugin installed typically expose the version number in the page source via wp-content/plugins/breakdance/ directory listing (if directory listing is enabled) or via the readme.txt file (when accessible).

Step 2: Vulnerability Trigger and Weaponization

Upon identifying a target running Breakdance version below 2.7, the attacker crafts a specially crafted HTTP request to an unauthenticated endpoint of the plugin. This involves sending a GET or POST request to a specific URL or API route registered by the plugin that fails to enforce authorization checks. The attacker targets the plugin's REST API endpoints or admin-ajax.php handler with the appropriate action parameter that triggers the vulnerable function.

Step 3: Payload and Execution

The attacker sends the crafted request without any authentication tokens or cookies. The vulnerable code path processes the request and accesses data stored in the WordPress database or server-side files. The requested data is then returned to the attacker without requiring any prior authentication or authorization verification. Depending on the nature of the vulnerable function, the attacker could extract sensitive information such as private site settings, user data, email addresses, or other protected plugin configuration data.

Step 4: Post-Exploitation Impact

After successfully retrieving the sensitive information, the attacker may use the disclosed data for further attacks. For example, if user email addresses are leaked, they could be used for password spraying or phishing campaigns. If server configuration details are exposed, they could reveal additional attack vectors for gaining deeper access into the WordPress environment.

Impact Assessment

Business Impact:

This vulnerability poses a serious risk to organizations utilizing the Breakdance plugin. The primary impact is unauthorized information disclosure, which can result in the leakage of:

• User account data, including usernames and email addresses
• Private page or post content
• Site configuration and plugin settings
• Potential database credentials or API keys if stored insecurely

While the confidentiality impact is high, the integrity and availability unaffected, limiting the attack's direct impact to data exfiltration only.

CVSS Subscore Analysis:

The CVSS score of 7.5 is derived from the High confidentiality impact combined with the unauthenticated network-based attack vector. The low attack complexity and absence of user interaction mean that the attack can be automated, allowing malicious actors to sweep across multiple vulnerable sites with minimal effort.

Affected Systems:

All WordPress installations running the Breakdance plugin version 2.6.x or earlier are at risk. This includes hosted and self-hosted WordPress deployments, as well as those behind CDN or WAF services — though existing security layers could potentially block some attack vectors.

Blast Radius:

The blast radius is limited to the WordPress site hosting the vulnerable plugin. Since the attack requires no authentication, any publicly accessible WordPress installation running a vulnerable version is exploitable. This makes the vulnerability particularly dangerous for high-profile or multi-tenant WordPress hosting environments where multiple sites share the same codebase.

Detection Guidance

Sigma Rule

title: CVE-2026-65551 - Breakdance Plugin Authorization Bypass
id: 3a45c6d7-8b9f-4ed3-a54c-6d7f8a9b0c1d
status: experimental
description: Detects unauthenticated access attempts to Breakdance plugin endpoints
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-65551
author: ValtersIT Threat Intel Team
date: 2026/01/01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method:
            - 'GET'
            - 'POST'
        cs-uri-query|contains:
            - 'breakdance'
            - 'wp-ajax'
            - 'rest_route'
    condition: selection
    timeframe: 60s
level: high

YARA Rule

rule CVE_2026_65551_Breakdance_UA
{
    meta:
        author = "ValtersIT Threat Intel"
        description = "Detect exploitation attempts for CVE-2026-65551"
        cve = "CVE-2026-65551"
        date = "2026-01-01"
        severity = "high"
    strings:
        $a = "breakdance" ascii wide nocase
        $b = "admin-ajax.php" ascii wide nocase
        $c = "action=breakdance" ascii wide nocase
    condition:
        all of them
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-65551 - Breakdance Admin-Ajax Exploit Attempt"; content:"admin-ajax.php"; http_uri; content:"breakdance"; http_uri; nocase; sid:10065551; rev:1; metadata:cve CVE-2026-65551; classtype:attempted-information-leak;)

Elastic Detection

sequence by source.ip
    [network where match_on: dns and dns.question.name : "*breakdance*"]
    [http where event.category == "web" and url.path : "*admin-ajax.php*" and url.query : "*breakdance*"]

Splunk SPL Query

index=web sourcetype=access_combined
    uri_path IN ("*admin-ajax.php*", "*wp-json*", "*breakdance*")
    | where uri_path LIKE "%breakdance%" OR uri_query LIKE "%breakdance%" OR uri_query LIKE "%wp-ajax%"
    | eval risk_score=10
    | table _time, src_ip, user, method, uri_path, uri_query, status, risk_score
    | sort - _time

Wazuh OSSEC Rule

<group name="wordpress,">
  <rule id="934674" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">\.breakdance\.</field>
    <description>CVE-2026-65551 - Potential Breakdance Plugin Authorization Bypass Attempt</description>
    <group>cve-2026-65551</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY — 2 independent sources confirm fix)

1. Immediate Mitigations

• Update the Breakdance plugin to version 2.7 or later immediately. This is the only known fix for the vulnerability.
• Monitor WordPress access logs for suspicious unauthenticated requests targeting plugin endpoints or admin-ajax.php.
• Disable the Breakdance plugin temporarily if immediate updating is not possible, and if its functionality is not critical to business operations.
• Apply Web Application Firewall (WAF) rules to block unauthenticated requests containing the string "breakdance" in the URL query string.

2. Patch/Upgrade Steps

• Log into the WordPress admin panel.
• Navigate to Plugins → Installed Plugins.
• Locate the Breakdance plugin and check its current version.
• If version is below 2.7, click Update Now or manually download the latest version from the official Soflyy website.
• After updating, verify the plugin version is 2.7 or higher.
• Check for any compatibility issues with the updated plugin by testing critical site functionality.

3. Long-Term Hardening

• Implement a routine patch management schedule for all WordPress plugins, themes, and core installations.
• Enable automatic updates for WordPress plugins where feasible and compatible.
• Conduct regular security audits of installed plugins, removing any that are no longer actively maintained.
• Apply the principle of least privilege to all WordPress user roles, limiting administrative access to trusted personnel only.
• Deploy a comprehensive WAF solution that can detect and block known plugin vulnerability exploit patterns.
• Regularly review web server logs for anomalous traffic patterns originating from unknown IP addresses.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-65551
• Patchstack Vulnerability Database: https://patchstack.com/database/vulnerability/breakdance
• WordPress Plugin Repository: https://wordpress.org/plugins/breakdance/
• CWE-862 Reference: https://cwe.mitre.org/data/definitions/862.html
• ATT&CK Technique T1190: https://attack.mitre.org/techniques/T1190/

Exploit-in-the-Wild Evidence:

• Public PoC is available for this vulnerability, indicating that exploit code has been released to the public domain.
• No known active exploitation campaigns were identified in threat intelligence feeds at the time of this report.
• CISA KEV (Known Exploited Vulnerabilities) catalog does not currently list this CVE.