CVE-2026-18021
MediumCVSS 6.5Summary
The Beaver Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to and including 2.10.3.1 due to improper validation before running do_shortcode. This allows unauthenticated attackers to execute arbitrary shortcodes.
Risk Assessment
An attacker can execute arbitrary shortcodes, potentially leading to malicious code execution, data theft, or site takeover. Since no authentication is required, the risk is high.
Recommendation
Update the Beaver Builder plugin to the latest patched version immediately. Also, restrict access to the admin panel and monitor logs.
Other vulnerabilities in Beaver Builder
See all- CVE-2026-95865Medium
The Beaver Builder plugin for WordPress up to version 2.11.0.5 is vulnerable to blind SQL injection via the 'fields[][value]' parameter. Authenticated attackers with contributor-level access can modify SQL queries and extract sensitive data from the database.
- CVE-2025-12558Medium
The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.4 via the 'get_attachment_sizes' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the path and meta data of private attachments, which can be used to view the attachments.
- CVE-2025-12782Medium
The Beaver Builder – WordPress Page Builder plugin for WordPress in versions up to and including 2.9.4 is vulnerable to authorization bypass. The disable() function does not properly verify a user's authorization, allowing authenticated attackers with contributor-level access and above to disable the Beaver Builder layout on arbitrary posts and pages, causing content integrity issues and layout disruption.
- CVE-2025-11726Medium
The Beaver Builder – WordPress Page Builder plugin is vulnerable to Missing Authorization in all versions up to, and including, 2.9.4 due to insufficient capability checks in the REST API endpoints under the 'fl-controls/v1' namespace that control site-wide Global Presets. This makes it possible for authenticated attackers with contributor-level access and above to add, modify, or delete global color and background presets that affect all Beaver Builder content site-wide.
Original NVD description (English source)
The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.10.3.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS