The Beaver Builder Page Builder – Drag and Drop Website Builder plugin is vulnerable to blind SQL injection via the 'fields[][value]' parameter in all versions up to 2.11.0.5. The vulnerability arises from insufficient escaping and lack of prepared statements, allowing authenticated contributors to append additional SQL queries. Exploitation can result in extraction of sensitive database information.

The affected product is Beaver Builder Page Builder – Drag and Drop Website Builder, version 2.11.0.5 and earlier.

This vulnerability carries a CVSS score of 6.5 (medium). The EPSS score is not available, and it is not listed in the CISA KEV catalog. An attacker must have at least contributor-level access to a Beaver Builder post, which is required for the vulnerable get_autosuggest_values endpoint. The vulnerability description does not quantify how common contributor-level access is, so the overall risk depends on the site’s user roles. Based on the description, it is inferred that sites with multiple users who can edit Beaver Builder posts are more likely to have an attacker with the necessary access. Because injection is blind, detection requires observing side effects; however, once triggered, an attacker can extract sensitive data from the database.