Unauthenticated Arbitrary Shortcode Execution in Beaver Builder

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires the target site to have a Beaver Builder page containing the Sidebar module populated with a widget that displays attacker-controllable text, such as the core Recent Comments widget, with comment moderation disabled or the attacker's comment approved.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Beaver Builder is a widely-used WordPress page builder plugin trusted by thousands of sites for drag-and-drop website creation. CVE-2026-92084 exposes a critical flaw in versions up to 2.11.0.5 where the Sidebar module fails to properly validate user input before executing WordPress shortcodes. This allows unauthenticated attackers to inject and execute arbitrary shortcodes, potentially leading to remote code execution, data exfiltration, or complete site compromise. The vulnerability is particularly dangerous because it requires no authentication and affects any WordPress installation running the vulnerable plugin with at least one Beaver Builder page containing a Sidebar module—a common configuration.

Casky's 323 mapped security skills leverage Claude AI's extended reasoning to detect exploitation patterns across MITRE ATT&CK techniques TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners using Casky would identify attack indicators including: suspicious shortcode syntax in request logs and POST parameters targeting Beaver Builder endpoints, unusual PHP execution patterns following shortcode processing, and reconnaissance activity probing for Sidebar module presence. The platform's skill mapping would flag improper input validation patterns (CWE-94) and correlate findings with known exploitation chains, enabling defenders to spot both active exploitation attempts and post-compromise indicators before attackers establish persistence or move laterally within the WordPress environment.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-92084.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-92084

Casky has 323 skills that investigate the attack patterns behind CVE-2026-92084. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn