Breakdance 2.6.2 – Security Update

Breakdance 2.6.2 addresses a security vulnerability in the Design Library feature and includes a bug fix for the Gallery element.

Security Vulnerability

This update fixes an access control vulnerability in the Design Library’s public API endpoints. The vulnerability allowed unauthenticated users to bypass both Design Library password protection and WordPress post visibility settings (draft, private, password-protected) and retrieve content from non-published posts by making direct requests to the Design Library API endpoints.

This vulnerability only affects sites where the Design Library feature is enabled. The Design Library is disabled by default and must be manually activated by going to Breakdance > Settings > Design Library and enabling “Turn This Website Into a Design Set.”

Do you need to take immediate action?

Yes, if:

• You have enabled “Turn This Website Into a Design Set” in your Breakdance settings
• You have draft or private posts containing sensitive information
• You have set a Design Library password that you expected to protect your content

No immediate action needed if:

• You have not enabled the Design Library feature (this is the default state)
• You have not created a Design Set from your site

At this time, we are not aware of this vulnerability being exploited in the wild. The vulnerability requires the Design Library feature to be explicitly enabled, which is not the default setting in Breakdance.

Bug Fix

• Gallery lightbox now works when multiple Gallery elements are on the same page