WordPress Ultimate Addons for Beaver Builder version 1.2.4.1 contains an authentication bypass vulnerability that allows an attacker to gain administrative session cookies by submitting a crafted POST request to the admin-ajax.php endpoint with the uabb-lf-google-submit action, a valid administrator email, and a valid nonce. This flaw reflects CWE‑288, Improper Authentication, and enables attackers to impersonate privileged users, compromising the confidentiality and integrity of the WordPress site.

Any WordPress site that has the Ultimate Addons for Beaver Builder plugin, version 1.2.4.1, installed is affected. The plugin is developed by Ultimatebeaver and is commonly used to extend Beaver Builder functionality.

The CVSS score of 9.3 classifies this as a critical issue, underscoring the high impact of a successful exploit. The EPSS score is not available, so the current likelihood of exploitation cannot be quantified, but the fact that the vulnerability is remotely exploitable via a public HTTP request raises the risk considerably. The vulnerability is not listed in the CISA KEV catalog. Attackers can use the social media login form to trigger the flaw, meaning that the attack requires network access to the target site and knowledge of a valid administrator email and nonce. Once the attacker obtains the session cookie, they can access all administrative capabilities of the site.