Beaver Builder CVE-2026-95865

Requires an authenticated account with Contributor-level privileges or above, plus ownership of a draft post of a Beaver Builder post type - this causes the fl_ajax_update nonce to be emitted into the block editor, which is the token needed to reach the vulnerable get_autosuggest_values AJAX endpoint. The injectable input is the 'fields[][value]' parameter, which is insufficiently escaped and passed into an inadequately prepared SQL query. Limiting factors: exploitation is not possible without a valid low-privileged account (so sites that do not allow self-registration or untrusted contributors are far less exposed), and the attacker must control a draft post to harvest the nonce; the flaw is blind SQLi, so data must be inferred rather than read directly. No special server configuration is required beyond running Beaver Builder at or below version 2.11.0.5.

This is a genuine but moderate-priority issue rather than a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) is internally consistent with the description: network-reachable, low attack complexity, and requiring low privileges (Contributor), with a high confidentiality impact (blind SQL injection used to read sensitive database contents) and no integrity or availability impact. The authentication requirement (PR:L) is the single biggest risk-limiter - an attacker needs a valid Contributor-or-above account, which excludes purely external/unauthenticated mass exploitation but is realistic on multi-author or open-registration WordPress sites. No EPSS score was provided, KEV status is not indicated (treat as not listed), and no POC is referenced, so there is no public exploit identified at time of analysis. The signals are not conflicting: a medium CVSS, no active-exploitation signal, and an auth precondition all point the same direction - a legitimate SQL injection worth patching promptly, especially on sites with untrusted lower-privileged users, but not an unauthenticated internet-wide crisis. Note: EPSS and KEV data were absent from the input and could not be factored in.

An attacker who holds (or registers for) a Contributor account on a WordPress site running Beaver Builder creates or owns a draft post, which causes the block editor to emit the fl_ajax_update nonce needed to reach the get_autosuggest_values AJAX endpoint. They submit a crafted 'fields[][value]' parameter that appends attacker-controlled SQL to the existing query, then use blind SQL injection techniques to extract sensitive data such as password hashes and secret keys from the WordPress database. No public exploit code was identified in the provided data, so exploitation would require the attacker to develop the injection manually.