CVE-2026-95865: Beaver Builder Page Builder <= 2.11.0.5 - Authenticated (Contributor+) SQL Injection via 'fields[][value]' Parameter
The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to blind SQL Injection via 'fields[][value]' Parameter in all versions up to, and including, 2.11.0.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable getautosuggestvalues AJAX endpoint is reachable by any Contributor who owns a draft post, as the required flajaxupdate nonce is emitted into the block editor for any user who can edit a Beaver Builder post type.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker needs an authenticated WordPress account with Contributor-level access or higher. The affected AJAX endpoint is available to a Contributor who owns a draft post.
Is user interaction or special access required?
No victim interaction is required. The attacker must be able to edit a Beaver Builder post type and obtain the fl_ajax_update nonce emitted in the block editor.
What could an attacker obtain?
The blind SQL injection can be used to extract sensitive information from the WordPress database. The provided data does not indicate integrity or availability impact.
How can I determine whether my installation is affected?
Installations running Beaver Builder Page Builder version 2.11.0.5 or earlier are affected. Exposure is relevant where Contributor or higher roles can create or own draft posts for the Beaver Builder post type.