Improper neutralization of special elements in SQL commands allows a blind SQL injection in the Beaver Builder Lite plugin, enabling an attacker to read, modify or delete database contents. The vulnerability is identified as a CWE‑89 flaw that can lead to data compromise or unauthorized information disclosure.

All WordPress sites that are running the Beaver Builder Lite plugin version 2.10.1.2 or earlier are affected, regardless of the hosting environment. The vulnerable component is the Beaver Builder Lite plugin, which can be found in the WordPress plugin repository.

The CVSS score of 8.5 indicates high severity, while the exploit probability score is below 1%, suggesting a low likelihood of exploitation. Based on the description, it is inferred that the vulnerability can be exploited remotely via crafted HTTP requests to the plugin’s input handling endpoints. Because no publicly available exploits have been documented, the risk remains significant for exposed sites.