• Halloween is coming! To celebrate the occasion, we dusted off a couple of old skins, and even created a brand new one (Pixel).
    To get into the festive spirit, install the Skins extension.
  • The new Python extension is now available. It allows customers to deploy and manage WSGI-based Python applications on their websites directly from Plesk.
  • The Plesk Mobile apps for iOS and Android and the Plesk Mobile Center extension have been deprecated, and are no longer available for new installations. In Plesk Obsidian 18.0.84, the Plesk Mobile Center extension will be removed from servers during the upgrade, and the Plesk Mobile apps will lose their server management features.
  • The Social Login extension has been deprecated and will be removed in Plesk Obsidian 18.0.84. After that, it will no longer be possible to log in to Plesk with a Google, Facebook, GitHub account, or with a passkey. Plesk usernames and passwords, as well as logging in with a WebPros Account, are not affected.

WordPress Breakdance plugin <= 1.7.2 - Authenticated Remote Code Execution (RCE) vulnerability

K

KNEET

New Pleskian
Server operating system version
Cent
Plesk version and microupdate number
Plesk Obsidian v18.0.75_build1800260102.11 os_RedHat el8

WordPress Breakdance plugin <= 1.7.2 - Authenticated Remote Code Execution (RCE) vulnerability
Authenticated Remote Code Execution (RCE) vulnerability discovered by Snicco in WordPress Plugin Breakdance (versions <= 1.7.2)

I keep on getting this vulnerabiltiy detected by WP Toolkit and it seems likt it disables this plugin after scanning/finding it. Resulting it the site going offline.
We have a license for Breakdance and are already on the latest version 2.6.1

After a lot of troubleshooting it seems to be a Plesk issue.

Can anyone help?

Thanks
 
Hello, @KNEET . For the time being, please navigate to Plesk > Subscriptions > example.com > More > Check for updates > Update Settings. Then under "Defined individually, but security updates are autoinstalled", please make sure that "Deactivate vulnerable plugins instead of updating them" is unchecked. I will discuss the matter about the vulnerability mismatch with our team on Monday and follow up with more details.
 
Hi, @KNEET Just wanted to let you know that our team informed the Patchstack team and they are currently attempting to communicate with the extension vendor and further looking into the matter.
 
You must log in or register to reply here.

Similar threads

P
Issue WP Toolkit reports plugin as 0.0 security risk yet Wordfence DB says it's 9.8 Critical..!
Replies
2
Views
6K
burnley
burnley
P
Issue WP Toolkit email false-positive: patched plugin version is higher than notification describes
Replies
2
Views
1K
Sebahat.hadzhi
Sebahat.hadzhi
T
Resolved Auto-update of vulnerable plugins ("security updates are autoinstalled") never applies: daily task only reschedules (WP Toolkit 6.11 / cPanel)
Replies
4
Views
5K
Sebahat.hadzhi
Sebahat.hadzhi
P
Issue When Child Theme active WP Toolkit omits critically vulnerable Parent Theme from Vulnerable Components list
Replies
0
Views
10K
pleskuser67553
P
skibbler
"securityRiskFeature" not hiding Security-Risk score
Replies
4
Views
5K
skibbler
skibbler
Back
Top