{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40744", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-04-15T09:19:38.194Z", "datePublished": "2026-04-15T10:21:34.729Z", "dateUpdated": "2026-04-15T10:21:34.729Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "beaver-builder-lite-version", "product": "Beaver Builder", "vendor": "Beaver Builder", "versions": [{"changes": [{"at": "2.10.1.5", "status": "unaffected"}], "lessThanOrEqual": "2.10.1.2", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "daroo | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-15T12:20:47.859Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version allows Blind SQL Injection.<p>This issue affects Beaver Builder: from n/a through <= 2.10.1.2.</p>"}], "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version allows Blind SQL Injection.This issue affects Beaver Builder: from n/a through <= 2.10.1.2."}], "impacts": [{"capecId": "CAPEC-7", "descriptions": [{"lang": "en", "value": "Blind SQL Injection"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-15T10:21:34.729Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/beaver-builder-lite-version/vulnerability/wordpress-beaver-builder-plugin-2-10-1-2-sql-injection-vulnerability?_s_id=cve"}], "title": "WordPress Beaver Builder plugin <= 2.10.1.2 - SQL Injection vulnerability"}}}

{}

{}

{}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.10.1.2]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[2.10.1.5,*]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "matching"}]}, "original": {"product": "Beaver Builder", "source": "cna", "vendor": "Beaver Builder"}, "product": "beaver_builder", "vendor": "wpbeaverbuilder"}], "analysis": {"en": {"generated_at": "2026-04-15T11:51:40.105478+00:00", "value": {"mitigation_remediation": ["Upgrade the Beaver Builder Lite plugin to a version newer than 2.10.1.2.", "If an upgrade is not possible, disable or deactivate the plugin until a patch is released.", "Restrict the database credentials used by WordPress so that the plugin only has read access, limiting potential damage from injection."], "summary": {"action": "Apply Patch", "impact": "SQL Injection"}, "threat_synthesis": {"affected_systems": "All WordPress sites that are running the Beaver Builder Lite plugin version 2.10.1.2 or earlier are affected, regardless of the hosting environment. The vulnerable component is the Beaver Builder Lite plugin, which can be found in the WordPress plugin repository.", "description_and_impact": "Improper neutralization of special elements in SQL commands allows a blind SQL injection in the Beaver Builder Lite plugin, enabling an attacker to read, modify or delete database contents. The vulnerability is identified as a CWE\u201189 flaw that can lead to data compromise or unauthorized information disclosure.", "risk_and_exploitability": "The CVSS score is not listed, and EPSS data is unavailable, so the exploit likelihood is uncertain but the nature of SQL injection suggests high potential impact. The vulnerability can be exploited remotely via crafted HTTP requests to the plugin\u2019s input handling endpoints. No KEV listing indicates that widespread public exploits have not been documented, yet the risk remains significant for exposed sites."}}}}, "created": "2026-04-15T13:38:17.787970+00:00", "updated": "2026-04-15T13:44:58.884334+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpbeaverbuilder", "wpbeaverbuilder$PRODUCT$beaver_builder"]}