PT-2026-87029 · Beaver Builder · Beaver Builder Page Builder – Drag/Drop Website Builder

Kishan Vyas

·

CVE-2026-18021

·

Publicado

2026-09-08

·

Atualizado

2026-09-08

CVSS v3.1

6.5

Média

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.10.3.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Correção

Code Injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2026-18021

Produtos afetados

Beaver Builder Page Builder – Drag/Drop Website Builder