CVE-2026-95865
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The Beaver Builder plugin for WordPress up to version 2.11.0.5 is vulnerable to blind SQL injection via the 'fields[][value]' parameter. Authenticated attackers with contributor-level access can modify SQL queries and extract sensitive data from the database.
Risk Assessment
Risk of data leakage from the database, including passwords, personal data, or other confidential information.
Recommendation
Update the Beaver Builder plugin to the latest patched version. Restrict user privileges and monitor database activity.
Other vulnerabilities in Beaver Builder
See all- CVE-2026-18021Medium
The Beaver Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to and including 2.10.3.1 due to improper validation before running do_shortcode. This allows unauthenticated attackers to execute arbitrary shortcodes.
- CVE-2025-12558Medium
The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.4 via the 'get_attachment_sizes' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the path and meta data of private attachments, which can be used to view the attachments.
- CVE-2025-12782Medium
The Beaver Builder – WordPress Page Builder plugin for WordPress in versions up to and including 2.9.4 is vulnerable to authorization bypass. The disable() function does not properly verify a user's authorization, allowing authenticated attackers with contributor-level access and above to disable the Beaver Builder layout on arbitrary posts and pages, causing content integrity issues and layout disruption.
- CVE-2025-11726Medium
The Beaver Builder – WordPress Page Builder plugin is vulnerable to Missing Authorization in all versions up to, and including, 2.9.4 due to insufficient capability checks in the REST API endpoints under the 'fl-controls/v1' namespace that control site-wide Global Presets. This makes it possible for authenticated attackers with contributor-level access and above to add, modify, or delete global color and background presets that affect all Beaver Builder content site-wide.
Original NVD description (English source)
The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fields[][value]' Parameter in all versions up to, and including, 2.11.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable get_autosuggest_values AJAX endpoint is reachable by any Contributor who owns a draft post, as the required fl_ajax_update nonce is emitted into the block editor for any user who can edit a Beaver Builder post type.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS