CVE-2026-95865: Beaver Builder SQL Injection Vulnerability

CVE-2026-95865 Overview

CVE-2026-95865 is a blind SQL Injection vulnerability [CWE-89] in the Beaver Builder Page Builder plugin for WordPress. The flaw affects all versions up to and including 2.11.0.5. The vulnerable get_autosuggest_values AJAX endpoint fails to properly escape the fields[][value] parameter and does not use a prepared SQL statement. Authenticated users with Contributor-level access or higher can append arbitrary SQL to the backend query and extract sensitive data from the WordPress database.

Critical Impact

Contributor-level WordPress users can exfiltrate sensitive database contents, including user credentials and authentication secrets, through blind SQL injection against the Beaver Builder auto-suggest endpoint.

Affected Products

• Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress
• All versions through 2.11.0.5 (lite and premium builds sharing the auto-suggest code path)
• WordPress sites exposing the block editor to Contributor-level accounts

Discovery Timeline

• 2026-10-03 - CVE-2026-95865 published to NVD
• 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-95865

Vulnerability Analysis

The vulnerability lives in the Beaver Builder auto-suggest handler. The AJAX action fl_builder_autosuggest reaches FLBuilderAutoSuggest::init(), which queries the wp_postmeta and wp_posts tables based on attacker-controlled fields[][value] input. The handler concatenates this input directly into the SQL WHERE clause without calling $wpdb->prepare() or escaping with esc_sql().

Because the response does not reflect query results verbatim, the issue is exploited as blind SQL injection. Attackers use boolean conditions or time-based payloads such as SLEEP() to infer data one bit at a time. Over successive requests, this allows extraction of password hashes from wp_users, secret keys from wp_options, and session tokens stored in wp_usermeta.

Root Cause

The root cause is improper neutralization of SQL metacharacters in class-fl-builder-auto-suggest.php around lines 167 and 173, where the value field is interpolated into the dynamic query. The upstream AJAX dispatcher in class-fl-builder-ajax.php relies solely on the fl_ajax_update nonce for authorization. That nonce is emitted into the block editor for any user who can edit a Beaver Builder post type, so Contributors with a draft post obtain a valid token.

Attack Vector

An authenticated Contributor creates a draft post using a Beaver Builder-enabled post type and harvests the fl_ajax_update nonce from the editor HTML. The attacker then posts a crafted fields[][value] payload to admin-ajax.php targeting the fl_builder_autosuggest action. Each request measures response timing or boolean truth to leak one database character. The fix in changeset 3713226 (version 2.11.0.6) switches the query to a parameterized $wpdb->prepare() call.

The vulnerability manifests in the get_autosuggest_values method. See the Wordfence Vulnerability Report and the Beaver Builder Auto-Suggest Changeset for the exact code paths.

Detection Methods for CVE-2026-95865

Indicators of Compromise

• POST requests to /wp-admin/admin-ajax.php with action=fl_builder_autosuggest originating from Contributor accounts.
• fields[][value] parameter values containing SQL keywords such as SLEEP, BENCHMARK, UNION, SELECT, or inline comments like /*!.
• Repeated identical AJAX requests from the same user ID within short intervals, consistent with blind SQLi character-by-character extraction.
• Elevated wp_users or wp_options read volume in MySQL slow query logs tied to Beaver Builder auto-suggest queries.

Detection Strategies

• Monitor WordPress audit logs for Contributor accounts invoking fl_builder_autosuggest outside normal editor sessions.
• Alert on web application firewall rules matching SQL injection payloads in the fields array parameter.
• Correlate anomalous MySQL query durations exceeding one second against the originating admin-ajax.php request ID.

Monitoring Recommendations

• Enable WordPress query logging and ship records to a centralized SIEM for retention and correlation.
• Baseline normal admin-ajax.php request rates per user role and alert on deviations from Contributor accounts.
• Track new Contributor or Author account creation followed by rapid draft post creation and AJAX activity.

How to Mitigate CVE-2026-95865

Immediate Actions Required

• Upgrade Beaver Builder to version 2.11.0.6 or later on all WordPress installations.
• Audit existing user roles and remove unnecessary Contributor or Author accounts.
• Review MySQL and web server logs for prior exploitation attempts targeting fl_builder_autosuggest.
• Rotate WordPress authentication keys, salts, and administrator passwords if compromise is suspected.

Patch Information

The vendor released Beaver Builder 2.11.0.6 containing the fix. The patch, documented in the Beaver Builder Auto-Suggest Changeset, replaces the vulnerable string interpolation with a $wpdb->prepare() call that properly binds the fields[][value] parameter.

Workarounds

• Temporarily restrict the Beaver Builder post type editor to Editor or Administrator roles until the plugin is updated.
• Deploy a web application firewall rule blocking SQL keywords in POST bodies targeting the fl_builder_autosuggest action.
• Disable the Beaver Builder plugin on sites that cannot immediately patch and do not require page builder functionality.

# Configuration example: update plugin via WP-CLI
wp plugin update beaver-builder-lite-version --version=2.11.0.6
wp plugin list --name=beaver-builder-lite-version --fields=name,status,version