CVE-2019-25763: Beaver Builder Authentication Bypass Flaw

CVE-2019-25763 Overview

CVE-2019-25763 is an authentication bypass vulnerability in the WordPress Ultimate Addons for Beaver Builder plugin version 1.2.4.1. The flaw resides in the plugin's social media login form handler. Attackers can submit a crafted POST request to admin-ajax.php using the uabb-lf-google-submit action together with a valid administrator email address and a valid nonce. The server responds with session cookies that authenticate the attacker as the targeted administrator. The issue is tracked under CWE-288: Authentication Bypass Using an Alternate Path or Channel.

Critical Impact
Remote, unauthenticated attackers can obtain administrator session cookies and gain full control of vulnerable WordPress sites running the affected plugin version.

Affected Products

WordPress Ultimate Addons for Beaver Builder plugin version 1.2.4.1
WordPress installations using the affected plugin with the Google social login form enabled
Sites where administrator email addresses can be enumerated

Discovery Timeline

2026-06-20 - CVE-2019-25763 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2019-25763

Vulnerability Analysis

The vulnerability is an authentication bypass in the social media login feature of Ultimate Addons for Beaver Builder. The plugin exposes the uabb-lf-google-submit AJAX action through admin-ajax.php. This action is intended to authenticate users who sign in through Google. The handler validates a WordPress nonce and an email address, then issues session cookies for the matching WordPress account. The handler does not verify that the request originated from Google or that the submitter actually controls the email address provided.

Attackers who know or guess an administrator's email address can therefore authenticate as that user. The administrator email is often discoverable from author archives, REST API endpoints, or wp-json/wp/v2/users. The nonce required by the endpoint is exposed on public-facing pages that render the login form, so unauthenticated attackers can retrieve it directly.

Root Cause

The root cause is missing identity verification on the alternate authentication channel. The plugin treats the email field as a trusted identifier instead of validating a signed assertion from the Google identity provider. This pattern matches [CWE-288], where an alternate path to authentication skips checks that the primary path enforces.

Attack Vector

The attack is fully remote and requires no prior authentication or user interaction. An attacker collects an administrator email address, fetches a valid nonce from a page containing the social login form, and submits a single POST request to admin-ajax.php. The server returns session cookies that grant administrator-level access to /wp-admin. A public proof of concept is available at Exploit-DB entry 47832, and additional technical context is documented in the VulnCheck advisory.

Detection Methods for CVE-2019-25763

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing the parameter action=uabb-lf-google-submit from unfamiliar source IP addresses
Successful administrator logins not preceded by a corresponding wp-login.php POST request
New administrator accounts, plugin installations, or theme file modifications immediately following requests to the uabb-lf-google-submit action
Outbound requests from the web host to attacker-controlled infrastructure after suspicious AJAX traffic

Detection Strategies

Inspect web server access logs for POST requests to admin-ajax.php carrying the uabb-lf-google-submit action and correlate with subsequent privileged activity
Alert on session cookies (wordpress_logged_in_*) issued for administrator accounts without a preceding password authentication event
Monitor for enumeration of /wp-json/wp/v2/users and author archives, which precede targeting of administrator email addresses

Monitoring Recommendations

Forward WordPress, PHP, and web server logs to a centralized logging platform for retention and correlation
Enable file integrity monitoring on wp-content/plugins, wp-content/themes, and the WordPress core directory
Track creation and privilege changes on WordPress user accounts and alert on new administrator role assignments

How to Mitigate CVE-2019-25763

Immediate Actions Required

Update Ultimate Addons for Beaver Builder to a version later than 1.2.4.1 that addresses the authentication bypass
Rotate passwords and force re-authentication for all administrator accounts on affected sites
Audit the WordPress user table for unauthorized administrator accounts and remove any not explicitly provisioned
Review installed plugins, themes, and wp-content/uploads for webshells or unexpected PHP files

Patch Information

The vendor distributes updated versions of the plugin through the Ultimate Beaver product site. Site operators should apply the latest plugin release, which removes the unauthenticated authentication path in the uabb-lf-google-submit handler. After patching, verify the plugin version in wp-admin/plugins.php and confirm that exploitation attempts against the AJAX endpoint return an authentication error.

Workarounds

Disable or uninstall Ultimate Addons for Beaver Builder until the patched version can be deployed
Block requests to /wp-admin/admin-ajax.php containing action=uabb-lf-google-submit at the web application firewall
Restrict access to /wp-admin and admin-ajax.php by source IP where business requirements allow
Obfuscate administrator email addresses by disabling the WordPress REST API users endpoint and removing email exposure from author archives

bash

# Example WAF rule blocking the vulnerable AJAX action (ModSecurity)
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,id:1925763,phase:2,deny,status:403,log,msg:'Block CVE-2019-25763 UABB auth bypass'"
  SecRule ARGS:action "@streq uabb-lf-google-submit" "t:lowercase"