The Builderall Cheetah For WP plugin contains a missing capability check in the AJAX disable handler, allowing any authenticated user with Subscriber or higher role to alter the _ba_cheetah_enabled post meta field on any post. This grants the attacker the ability to deactivate the page builder layout on posts they do not own, effectively changing the appearance or functionality of those pages. The vulnerability arises from direct usage of the user‑supplied post_id without validation or nonce checking, which is a classic authorization bypass (CWE‑862).

WordPress sites using the Builderall Cheetah For WP plugin version 3.0.2 or earlier are affected. The vulnerability is tied to the plugin's wp_ajax_ba_cheetah_disable AJAX handler and targets the post meta '_ba_cheetah_enabled'. Sites must identify whether they still run the vulnerable plug‑in version and if the AJAX endpoint is exposed.

The CVSS score of 4.3 indicates medium severity. EPSS data is not available, so the likelihood of exploitation cannot be quantified from the public data, but the lack of a nonce and capability check makes the flaw straightforward to exploit by any user with Subscriber role or higher. The vulnerability is not yet listed in the CISA KEV catalog. An attacker can exploit the flaw by sending a crafted AJAX request to wp-admin/admin-ajax.php, providing a ba_cheetah_data[post_id] value of a target post, thereby setting the post meta to false and disabling the page builder on that content.