Blind SQL Injection in Beaver Builder Page Builder for WordPress

CVE-2026-95865

What is CVE-2026-95865?

The Beaver Builder Page Builder plugin, utilized within WordPress, is susceptible to a blind SQL injection vulnerability via the 'fields[][value]' parameter. This security flaw stems from inadequate escaping of user-supplied data and insufficient preparation of the associated SQL queries. Authenticated users, specifically those with contributor-level access and higher, can exploit this vulnerability by injecting additional SQL queries into existing ones, thereby potentially gaining access to sensitive database information. Notably, the vulnerable AJAX endpoint, get_autosuggest_values, can be accessed by Contributors managing draft posts, as the required nonce is available within the block editor to any user permitted to edit Beaver Builder post types.

References