Description

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.10.3.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-08T12:16:53.400Z",
  "pubdate": "2026-09-08T12:16:53.400Z",
  "executiveSummary": "The Beaver Builder Page Builder plugin for WordPress is susceptible to an arbitrary shortcode execution vulnerability, identified in all versions up to and including 2.10.3.1. This flaw stems from improper input validation within a specific plugin action before processing data with the do_shortcode function.\nThis vulnerability is critical because it allows unauthenticated, remote attackers to trigger the execution of arbitrary shortcodes on the target WordPress installation. By crafting a malicious request, an attacker can leverage this weakness to execute functionality intended only for authorized users, potentially leading to unauthorized data exposure, content manipulation, or the compromise of site integrity.\nBecause the vulnerability does not require authentication or elevated privileges, it presents a significant risk to any site utilizing affected versions of the plugin. Exploitation is facilitated via network access to the vulnerable WordPress instance, making it a highly accessible vector for malicious actors.",
  "technicalDetails": "The vulnerability resides in the core handling logic of the Beaver Builder Page Builder plugin, specifically where user-supplied input is processed through the do_shortcode WordPress function. The root cause is a failure to properly sanitize or validate user input before passing it to this powerful function, which parses and executes shortcodes embedded within content.\nShortcodes are specialized WordPress macros that allow developers to execute complex PHP functions by embedding simple tags (e.g., [shortcode]) in posts or pages. When do_shortcode is invoked, the WordPress engine parses these tags and executes the associated registered callback functions. By failing to validate the input supplied to this execution path, the plugin allows unauthenticated users to influence the payload processed by do_shortcode.\nThe attack flow begins with an unauthenticated attacker identifying the vulnerable action exposed by the plugin. The attacker then crafts a malicious HTTP request targeting the affected endpoint. This request includes a payload containing an arbitrary shortcode or a series of shortcodes chosen by the attacker. Because the plugin does not enforce authentication or validate that the provided input is legitimate, the application proceeds to pass this malicious payload into the do_shortcode function.\nUpon execution of the crafted shortcode, the server will interpret and execute the underlying code associated with that shortcode tag. The post-exploitation impact is limited only by the capabilities of the available shortcodes registered within the WordPress environment. An attacker could potentially utilize this to trigger unauthorized actions, disclose sensitive information rendered by shortcode outputs, or modify site content depending on the functionality of the shortcodes available on the site.\nThis vulnerability affects all versions of the Beaver Builder Page Builder plugin up to and including version 2.10.3.1. It is accessible over the network without requiring any prior authentication or specific privilege level, significantly lowering the barrier to entry for exploitation. The lack of validation effectively turns the do_shortcode function into an execution primitive for the attacker, bypassing security controls that would otherwise restrict the use of these functions to authorized administrators or content editors."
}