Beaver Builder Page Builder: Unauthenticated arbitrary shortcode execution

Summary

Beaver Builder Page Builder for WordPress up to and including 2.11.0.5 does not properly validate a value before it is passed to do_shortcode. An unauthenticated attacker can execute arbitrary WordPress shortcodes. Exploitation requires a Beaver Builder page with a Sidebar module that displays attacker-controllable text, such as Recent Comments, and comment moderation disabled or the attacker's comment approved.

Affected

• Beaver Builder Page Builder (Lite and Pro) up to and including 2.11.0.5

Fixed in

• Version 2.11.0.6 (according to third-party sources and the WordPress.org listing; vendor advisory not found)

Workaround

• No vendor workaround found.
• Interim measure: remove Sidebar-module widgets that display visitor-supplied text, and keep comment moderation enabled until the update is applied.

Exploitation

• No in-the-wild exploitation found. CISA KEV listing not confirmed.
• EPSS: 0.53% according to a third-party tracker.
• A third-party public proof-of-concept repository exists.
• CVSS 9.1 (CNA) versus 4.8 (WPScan); the 9.1 score is used as planning baseline.

Our recommendation

• Identify all WordPress sites running Beaver Builder (Lite or Pro).
• Update to version 2.11.0.6 or later and verify the installed version.
• Check Sidebar-module layouts for widgets that display visitor-controlled text.
• Prioritise internet-facing sites, as no login is required.
• Monitor logs for unusual shortcode-related requests.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  Hassham1/CVE-2026-92084-beaver-builder-shortcode-poc

Research sources

• Wordfence threat intelligence record www.wordfence.com
• WordPress plugin trac changeset 3713226 plugins.trac.wordpress.org
• WPScan plugin entry wpscan.com
• WordPress.org plugin listing en-gb.wordpress.org
• Lilting analysis article lilting.ch
• VulDB entry vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:35.