Beaver Builder – WordPress Page Builder (Free & Pro) <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module
- ID
- WPSEC-2026-0279
- Plugin
- Beaver Builder Page Builder – Drag and Drop Website Builder (beaver-builder-lite-version)
- Affected
- all versions before 2.11.0.6
- Remediation
- Update to 2.11.0.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-94
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Beaver Builder – WordPress Page Builder (Free & Pro) on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-92084, on 2026-10-02.
Description
The Beaver Builder Page Builder plugin for WordPress is vulnerable to arbitrary shortcode execution via the Sidebar module in all versions up to, and including, 2.11.0.5. This is due to the layout's shortcode pass running over the output of dynamic_sidebar(), which can contain untrusted user data such as comment author names or comment text shown by the core Recent Comments widget or Latest Comments block. The fix for CVE-2026-18021 in 2.10.3.2 neutralized shortcodes in the output of the Widget, Reusable Block and ACF Block modules but not the Sidebar module. This makes it possible for unauthenticated attackers whose comment has been approved to execute arbitrary shortcodes when a page uses the Sidebar module to display a sidebar containing such a widget.
References
- https://wpsec.com/vuln/WPSEC-2026-0279/
- https://plugins.svn.wordpress.org/beaver-builder-lite-version/tags/2.11.0.6/
- https://wordpress.org/plugins/beaver-builder-lite-version/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS