Note by Patchstack

This is not a false positive. The Client Mode "Edit Content" which is meant to grant limited content edit access to users on Breakdance is by default vulnerable to RCE. Regardless of the existing warnings in place, code execution on the lowest permission available is against common access control principles and should not be made possible. Researcher advisory - https://snicco.io/vulnerability-disclosure/breakdance/client-mode-remote-code-execution-breakdance-1-7-0

This could allow a malicious actor to execute commands on the target website. This can be used to gain backdoor access to then take full control of the website.

CVSS score is a way to evaluate and rank reported vulnerabilities in a standardized and repeatable way but which is not ideal for WordPress.