CVE-2026-15823: Builderall for WordPress <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter
The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable() function in versions up to, and including, 3.0.2. The wpajaxbacheetahdisable AJAX handler is registered without any capability or nonce verification, and the target postid is sourced directly from user-controlled $POST['bacheetahdata']['postid']. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disable the page builder layout on arbitrary posts by setting the bacheetahenabled post meta to false, including on posts owned by other users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Builderall Cheetah For Wp plugin for WordPressto a version that resolves this vulnerability.Fixed in 3.0.2 - Configuration
After applying the fix, verify and correct the _ba_cheetah_enabled post meta for any posts that may have been modified by authenticated attackers (Subscriber+), including posts owned by other users.
WordPress (Builderall Cheetah For Wp plugin) _ba_cheetah_enabled post meta = false - Compensating control
Restrict access to the WordPress AJAX action wp_ajax_ba_cheetah_disable so only users who have an appropriate capability for disabling the page builder layout can invoke it, and ensure requests are validated (e.g., capability/nonce verification) before processing a user-supplied post_id.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with Subscriber-level access or higher can exploit it. The attacker does not need to own the targeted post.
What access or interaction does exploitation require?
An attacker needs a valid authenticated WordPress account and must be able to send a request to the plugin's AJAX handler. No user interaction is required, and the handler lacks both capability and nonce verification.
What can an attacker change?
The attacker can set the _ba_cheetah_enabled post meta value to false for arbitrary posts, disabling the Builderall Cheetah page builder layout. The provided data describes an integrity impact only; it does not indicate confidentiality or availability impact.
How can I determine whether a site is affected?
Sites using Builderall Cheetah For Wp version 3.0.2 or earlier are affected according to the available information. Review post metadata for unexpected _ba_cheetah_enabled values set to false, particularly on posts whose owners did not make the change.