CVE-2026-40744
Blind SQL Injection in Beaver Builder ≤ 2.10.1.2 Allows Data Exposure
Publication date: 2026-04-15
Last updated on: 2026-04-16
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| beaver_builder | beaver_builder_lite | to 2.10.1.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-40744 is a SQL Injection vulnerability found in the WordPress Beaver Builder Plugin versions up to and including 2.10.1.2.
This vulnerability allows a malicious actor with at least Contributor or Developer privileges to interact directly with the website's database without proper authorization.
It is classified under the OWASP Top 10 category A3: Injection, indicating that it involves improper neutralization of special elements in SQL commands.
How can this vulnerability impact me? :
This vulnerability can lead to serious impacts such as data theft or manipulation by unauthorized users.
Since attackers can execute blind SQL injection, they may extract sensitive information or alter database contents, potentially compromising the integrity and confidentiality of your website's data.
The vulnerability has a high CVSS severity score of 8.5, indicating a significant risk.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is a Blind SQL Injection in the Beaver Builder WordPress plugin versions up to 2.10.1.2. Detection typically involves testing for SQL injection points in the plugin's input fields or parameters accessible to users with Contributor or Developer privileges.
Common detection methods include using automated vulnerability scanners that support SQL injection detection or manual testing with tools like sqlmap targeting the plugin endpoints.
Example command using sqlmap to test a URL parameter (replace URL and parameter accordingly):
- sqlmap -u "http://example.com/?param=value" --level=5 --risk=3 --batch
Additionally, monitoring web server logs for suspicious database errors or unusual query patterns related to Beaver Builder plugin requests can help identify exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to update the Beaver Builder plugin to version 2.10.1.5 or later, where this SQL Injection vulnerability has been patched.
If immediate updating is not possible, restrict or review user privileges to ensure that only trusted users have Contributor or Developer roles, as the vulnerability requires such privileges to be exploited.
Implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting the plugin.
Enable automatic updates for plugins if supported by your WordPress environment to reduce the window of exposure.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
CVE-2026-40744 is a SQL Injection vulnerability that allows malicious actors with certain privileges to interact directly with the website's database, potentially leading to data theft or manipulation.
Such unauthorized access and potential data breaches can impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive data against unauthorized access and breaches.
Failure to patch this vulnerability could result in violations of these standards due to compromised data integrity and confidentiality.