CVE-2026-92084: Beaver Builder WordPress Plugin RCE Flaw

CVE-2026-92084 Overview

CVE-2026-92084 is an arbitrary shortcode execution vulnerability in the Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress. The flaw affects all versions up to and including 2.11.0.5. The plugin invokes do_shortcode on attacker-influenced content without proper validation, allowing unauthenticated attackers to execute arbitrary WordPress shortcodes. Exploitation requires a Beaver Builder page containing the Sidebar module populated with a widget that renders attacker-controllable text, such as the core Recent Comments widget with comment moderation disabled or an approved comment. The vulnerability is categorized under CWE-94: Improper Control of Generation of Code.

Critical Impact

Unauthenticated attackers can execute arbitrary shortcodes on vulnerable WordPress sites, enabling access to sensitive site content and functionality exposed through registered shortcode handlers.

Affected Products

• Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress
• Beaver Builder Lite versions up to and including 2.11.0.5
• WordPress sites running vulnerable Beaver Builder versions with the Sidebar module in use

Discovery Timeline

• 2026-10-03 - CVE-2026-92084 published to NVD
• 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-92084

Vulnerability Analysis

The vulnerability stems from the Beaver Builder plugin passing untrusted content to WordPress's do_shortcode function without first validating or sanitizing the input. Shortcodes in WordPress are code tokens that, when parsed, trigger associated PHP handlers. When attacker-controlled text reaches a shortcode-processing function, any registered shortcode can be executed with the privileges of the rendering context.

In this case, the Sidebar module renders widget output on Beaver Builder pages. The core Recent Comments widget displays comment author text, which an unauthenticated visitor can submit. If comment moderation is disabled or a prior comment has been approved, the attacker's text is embedded into the page. The plugin then passes that text through do_shortcode, allowing injected shortcode tokens to execute.

Root Cause

The root cause is improper code generation control [CWE-94]. The Sidebar module's rendering path, implemented in modules/sidebar/sidebar.php and modules/sidebar/includes/frontend.php, invokes do_shortcode on widget output. Comment-sourced content from the Recent Comments widget is treated as trustworthy template content rather than untrusted user input. The fix landed in Beaver Builder changeset 3713226, which modifies modules/sidebar/sidebar.php to prevent shortcode processing on widget-produced content.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker submits a comment containing a WordPress shortcode payload to a target site that uses a Beaver Builder page with the Sidebar module and the Recent Comments widget. Once the comment is auto-approved, or if moderation is disabled, the shortcode is rendered when the page is served. See the Wordfence Vulnerability Analysis for additional detail on the exploitation prerequisites.

No verified public exploit code is available. The vulnerability mechanism is documented in the Beaver Builder Lite Sidebar Module and the Beaver Builder Lite Frontend Module source references.

Detection Methods for CVE-2026-92084

Indicators of Compromise

• Approved or pending WordPress comments containing shortcode tokens such as [ and ] with recognized shortcode tags in the author name or comment body
• Unexpected shortcode output rendered inside Recent Comments widgets on Beaver Builder pages
• Access log entries showing POST requests to wp-comments-post.php followed by anonymous GET requests to pages that embed the Sidebar module
• Beaver Builder plugin version at or below 2.11.0.5 reported by WordPress site inventory tooling

Detection Strategies

• Scan the WordPress wp_comments table for comment_author and comment_content values containing shortcode patterns matching registered shortcode tags
• Audit Beaver Builder page layouts for use of the Sidebar module paired with the Recent Comments widget
• Review web server logs for anonymous comment submissions correlated with subsequent page renders of affected URLs

Monitoring Recommendations

• Alert on WordPress plugin inventory changes that keep Beaver Builder below the patched release
• Monitor the comments moderation queue and flag entries containing bracketed shortcode syntax
• Track outbound requests originating from the WordPress host that correlate with page renders, since shortcodes can trigger server-side behaviors

How to Mitigate CVE-2026-92084

Immediate Actions Required

• Update the Beaver Builder Page Builder plugin to a version later than 2.11.0.5 that includes changeset 3713226
• Enable comment moderation so that no comment is published without administrator approval
• Review existing approved comments for shortcode payloads and remove any suspicious entries
• Audit Beaver Builder pages and remove the Recent Comments widget from Sidebar modules until the plugin is patched

Patch Information

The vendor addressed the vulnerability in the Beaver Builder Lite Changeset Update, which modifies modules/sidebar/sidebar.php to prevent shortcode execution on widget-rendered content. Site administrators should upgrade to the first Beaver Builder release that includes this changeset.

Workarounds

• Disable the Sidebar module on Beaver Builder pages until the plugin is updated
• Remove or disable the Recent Comments widget from any sidebar used by Beaver Builder layouts
• Require manual moderation for all comments to block unauthenticated injection paths
• Restrict comment submission to authenticated users via WordPress discussion settings