Beaver Builder – WordPress Page Builder (Free & Pro) <= 2.11.0.5 - Authenticated (Contributor+) SQL Injection via Auto-Suggest Field Values
- ID
- WPSEC-2026-0280
- Plugin
- Beaver Builder Page Builder – Drag and Drop Website Builder (beaver-builder-lite-version)
- Affected
- all versions before 2.11.0.6
- Remediation
- Update to 2.11.0.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-89
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Beaver Builder – WordPress Page Builder (Free & Pro) on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-95865, on 2026-10-02.
Description
The Beaver Builder Page Builder plugin for WordPress is vulnerable to SQL Injection via the post ids passed to the 'get_autosuggest_values' builder AJAX action in all versions up to, and including, 2.11.0.5. This is due to insufficient escaping of the user-supplied value and lack of sufficient preparation of the SQL query: the ids were only checked for truthiness and the raw strings were then inserted directly into the ORDER BY FIELD clause of the post lookup query. This makes it possible for authenticated attackers with contributor-level access and above, who can edit a post of a Beaver Builder-enabled post type, to append additional SQL to existing queries and extract sensitive information from the database.
References
- https://wpsec.com/vuln/WPSEC-2026-0280/
- https://plugins.svn.wordpress.org/beaver-builder-lite-version/tags/2.11.0.6/
- https://wordpress.org/plugins/beaver-builder-lite-version/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS