CVE-2026-95865 beaverbuilder CVE debrief

Who should care

WordPress site administrators, security teams, and contributors who own draft posts should assess exposure and apply patches to prevent potential data breaches and disruptions. These stakeholders must verify patch application and monitor database activity to ensure the vulnerability is remediated.

Why it matters

CVE-2026-95865 is a blind SQL injection vulnerability in the Beaver Builder Page Builder plugin for WordPress. Site administrators and security teams should assess exposure, apply patches, and monitor database activity to prevent potential data breaches and disruptions.

• Potential extraction of sensitive database information by authenticated attackers.
• Possible disruption of database operations through appended SQL queries.
• Increased risk of data breaches due to insufficient input validation.
• Verification of patch application and vulnerability remediation required.

Technical summary

The Beaver Builder Page Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'fields[][value]' parameter in all versions up to, and including, 2.11.0.5. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. Authenticated attackers with contributor-level access and above can append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Defensive priority

Medium priority for WordPress site administrators and security teams to assess exposure and apply patches.

Recommended defensive actions

• Assess exposure by checking if the plugin version is 2.11.0.5 or earlier.
• Verify contributor-level access controls and authentication mechanisms.
• Apply patches or updates to the plugin as soon as available.
• Monitor database queries and sensitive information access.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is confirmed in plugin versions up to 2.11.0.5. The get_autosuggest_values AJAX endpoint is vulnerable and can be accessed by Contributors who own a draft post. This endpoint allows attackers to inject malicious SQL queries. To verify patch application, defenders should review the plugin version and monitor database queries for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.