Improper neutralization of special elements in SQL commands allows a blind SQL injection in the Beaver Builder Lite plugin, enabling an attacker to read, modify or delete database contents. The vulnerability is identified as a CWE‑89 flaw that can lead to data compromise or unauthorized information disclosure.

All WordPress sites that are running the Beaver Builder Lite plugin version 2.10.1.2 or earlier are affected, regardless of the hosting environment. The vulnerable component is the Beaver Builder Lite plugin, which can be found in the WordPress plugin repository.

The CVSS score is not listed, and EPSS data is unavailable, so the exploit likelihood is uncertain but the nature of SQL injection suggests high potential impact. The vulnerability can be exploited remotely via crafted HTTP requests to the plugin’s input handling endpoints. No KEV listing indicates that widespread public exploits have not been documented, yet the risk remains significant for exposed sites.