rootpwn

critical · CVSS v3 9.1 · EPSS 0.00531

CVE-2026-92084

The Beaver Builder Page Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to 2.11.0.5. This fla

Overview

The Beaver Builder Page Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to 2.11.0.5. This flaw allows unauthenticated attackers to run any shortcode on a site that has a Beaver Builder page with a Sidebar module containing an attacker‑controllable widget. The vulnerability can lead to remote code execution or data exfiltration.

Description

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires the target site to have a Beaver Builder page containing the Sidebar module populated with a widget that displays attacker-controllable text, such as the core Recent Comments widget, with comment moderation disabled or the attacker's comment approved.

Impact

Confidentiality, Integrity, and Availability are at risk. Site owners, administrators, and visitors could be impacted if attackers inject malicious shortcodes that execute arbitrary code or exfiltrate data.

Remediation

Upgrade Beaver Builder to version 2.11.0.6 or later. If an upgrade is not possible, disable the Sidebar module or remove widgets that allow user‑controlled text, or enable comment moderation. Additionally, restrict the do_shortcode function to trusted users via role checks.

Risk context

Severity is critical with CVSS 9.1 and EPSS 0.00531, indicating a high likelihood of exploitation. Immediate action is recommended.

Affected products

  • Beaver Builder Page Builder plugin
  • WordPress Beaver Builder

Scores

Severity
critical
CVSS v2
9.4
CVSS v3
9.1
CVSS v4
—
EPSS
0.00531

WordPress plugin shortcode arbitrary code execution unauthenticated Beaver Builder webapp

← All CVEs

Related CVEs

critical

CVE-2026-105134

A critical OS command injection flaw exists in Ahsay AhsayCBS 10.3.2 and earlier, triggered via the random parameter in /rps/api/json/UpdateReceivers.do. Attackers can execute arbitrary commands remotely without authentication. The vulnerability is publicly exploited and can compromise system integrity and availability.

View analysis

critical

CVE-2026-105123

A critical remote code execution flaw exists in Vincent Peugnet's WCMS (v3.18.0) that lets authenticated editors upload arbitrary files via the media upload API. The vulnerability allows path traversal to write files outside the media directory and delete arbitrary files, enabling execution of malicious PHP code. This flaw can be exploited by anyone with editor credentials to compromise the web server.

View analysis

critical

CVE-2026-88779

Citrix NetScaler ADC and Gateway are affected by a critical vulnerability that could allow attackers to compromise the confidentiality, integrity, and availability of network traffic and services. The flaw exists in versions prior to 14.1-73.41 and 13.1-64.28 for ADC, and similar pre‑release versions for Gateway. It is exploitable by remote actors with network access.

View analysis

critical

CVE-2026-105135

InternLM MindSearch 0.1.0 is vulnerable to remote code injection via the Planner Agent's ExecutionAction.run function. The flaw allows attackers to execute arbitrary code on the host. This can compromise confidentiality, integrity, and availability of affected systems.

View analysis