CVE-2026-15823: Builderall Cheetah WP Auth Bypass Flaw

CVE-2026-15823 Overview

CVE-2026-15823 affects the Builderall Cheetah For WP plugin for WordPress in versions up to and including 3.0.2. The plugin registers the wp_ajax_ba_cheetah_disable AJAX handler without capability or nonce verification. Authenticated attackers with Subscriber-level access or higher can disable the page builder layout on arbitrary posts, including posts owned by other users. The flaw is a missing authorization issue tracked under [CWE-862].

Critical Impact
Any authenticated Subscriber can toggle the _ba_cheetah_enabled post meta to false on any post, resulting in unauthorized modification of published content.

Affected Products

Builderall Cheetah For WP plugin for WordPress
Versions up to and including 3.0.2
WordPress sites with Subscriber-level or higher registration enabled

Discovery Timeline

2026-09-10 - CVE-2026-15823 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-15823

Vulnerability Analysis

The vulnerability resides in the disable() function of the class-ba-cheetah-model.php class. The function is exposed through the wp_ajax_ba_cheetah_disable AJAX action, which WordPress makes accessible to any authenticated user. The handler performs no current_user_can() capability check and does not verify a nonce with check_ajax_referer().

Because the handler accepts the target post_id directly from $_POST['ba_cheetah_data']['post_id'], an attacker controls which post is modified. The function then sets the _ba_cheetah_enabled post meta value to false, disabling the Cheetah page builder layout for that post. This breaks the rendered layout on the front end without altering the underlying post content.

Root Cause

The root cause is a broken access control pattern [CWE-862]. The plugin trusts that any authenticated caller reaching the AJAX endpoint is authorized to modify the target post. Neither ownership of the post nor a specific capability such as edit_post is validated before the meta update executes.

Attack Vector

An attacker registers a Subscriber account or uses existing low-privilege credentials. The attacker sends an authenticated POST request to /wp-admin/admin-ajax.php with action=ba_cheetah_disable and a ba_cheetah_data[post_id] value pointing to any post identifier. The server processes the request and flips the _ba_cheetah_enabled meta for that post to false. Refer to the Wordfence Vulnerability Report and the plugin source code for the vulnerable implementation.

Detection Methods for CVE-2026-15823

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=ba_cheetah_disable originating from low-privilege user sessions.
Post meta values of _ba_cheetah_enabled set to false on posts that were previously rendered with the Cheetah builder.
Front-end layout regressions on published pages coinciding with Subscriber account activity.

Detection Strategies

Audit WordPress access logs for admin-ajax.php requests with the ba_cheetah_disable action and correlate the requester role against post ownership.
Query the wp_postmeta table for recent changes to _ba_cheetah_enabled and cross-reference with the post_modified timestamp of the parent post.
Enable WordPress activity logging plugins to capture unauthorized meta modifications by non-editor accounts.

Monitoring Recommendations

Alert on any authenticated request to ba_cheetah_disable from users lacking the edit_posts capability.
Baseline the volume of AJAX calls from Subscriber accounts and flag deviations, especially bursts targeting sequential post_id values.
Monitor for newly created Subscriber accounts that immediately issue requests to plugin AJAX handlers.

How to Mitigate CVE-2026-15823

Immediate Actions Required

Update the Builderall Cheetah For WP plugin to a version later than 3.0.2 once the vendor releases a patched build.
Restrict new user registration or disable the Subscriber role on sites that do not require public sign-ups.
Review posts using the Cheetah builder for unexpected _ba_cheetah_enabled=false values and restore them where necessary.

Patch Information

At the time of publication, the Wordfence Vulnerability Report is the authoritative source for patch status. Administrators should monitor the plugin's WordPress.org repository for a release addressing the missing capability check in the disable() handler.

Workarounds

Block requests to /wp-admin/admin-ajax.php where the action parameter equals ba_cheetah_disable using a Web Application Firewall (WAF) rule.
Deactivate the Builderall Cheetah For WP plugin until a patched version is available if the site does not require the builder.
Enforce role hardening so Subscriber accounts cannot invoke plugin AJAX endpoints, using a capability management plugin as a compensating control.

bash

# Configuration example - WAF rule to block the vulnerable AJAX action
# ModSecurity rule blocking ba_cheetah_disable from non-editor users
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1026158230,\
   msg:'CVE-2026-15823 Builderall Cheetah unauthorized disable'"
  SecRule ARGS:action "@streq ba_cheetah_disable"