Beaver Builder vulnerabilities

The Beaver Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to and including 2.10.3.1 due to improper validation before running do_shortcode. This allows unauthenticated attackers to execute arbitrary shortcodes.

The Beaver Builder plugin for WordPress up to version 2.11.0.5 is vulnerable to blind SQL injection via the 'fields[][value]' parameter. Authenticated attackers with contributor-level access can modify SQL queries and extract sensitive data from the database.

The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.4 via the 'get_attachment_sizes' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the path and meta data of private attachments, which can be used to view the attachments.

The Beaver Builder – WordPress Page Builder plugin for WordPress in versions up to and including 2.9.4 is vulnerable to authorization bypass. The disable() function does not properly verify a user's authorization, allowing authenticated attackers with contributor-level access and above to disable the Beaver Builder layout on arbitrary posts and pages, causing content integrity issues and layout disruption.

The Beaver Builder – WordPress Page Builder plugin is vulnerable to Missing Authorization in all versions up to, and including, 2.9.4 due to insufficient capability checks in the REST API endpoints under the 'fl-controls/v1' namespace that control site-wide Global Presets. This makes it possible for authenticated attackers with contributor-level access and above to add, modify, or delete global color and background presets that affect all Beaver Builder content site-wide.