Beaver Builder EUVD-2026-91966

Exploitation is gated on a specific configuration: the target must publish a Beaver Builder page containing the Sidebar module populated with a widget that renders attacker-controllable text - the description names the core Recent Comments widget - AND comment moderation must be disabled (comments auto-approved) or the attacker's comment must be approved by a moderator. Limiting factors: this is a non-default content/layout combination the attacker cannot guarantee, and reliance on comment approval introduces either an auto-approval misconfiguration or human-in-the-loop interaction. Where present, the attack itself needs no authentication (PR:N) and no victim UI interaction, but the dependency on site-controlled configuration substantially narrows exploitable targets.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores 9.1 and portrays an unauthenticated, low-complexity, remote code-injection flaw (CWE-94) - normally an urgent priority. However, the description materially qualifies this: successful exploitation requires a specific non-default deployment (a Beaver Builder page rendering the Sidebar module populated with a widget that echoes attacker-controllable text, e.g. the core Recent Comments widget) AND that comment moderation be disabled or the attacker's comment approved. That precondition conflicts with the AC:L rating - the real-world attack complexity is closer to AC:H because the attacker depends on site configuration they do not control. No EPSS score, SSVC decision, KEV listing, or POC is provided in the input, so there is no evidence of active exploitation or published exploit code; exploitation status is therefore 'no public exploit identified at time of analysis.' Net assessment: a genuinely serious bug in a popular plugin, but the configuration dependency makes it more conditional/targeted than the 9.1 implies - triage as high but not drop-everything, and confirm whether affected sites actually expose the vulnerable Sidebar/widget combination.

An unauthenticated attacker submits a blog comment containing a WordPress shortcode payload on a site running a vulnerable Beaver Builder version. If the site auto-approves comments (or the comment is later approved) and a Beaver Builder page renders the Sidebar module with the Recent Comments widget, the plugin passes the comment text through do_shortcode without validation, executing the attacker's shortcode in the page context. No public POC is identified in the provided data.