CVE-2026-92084: Beaver Builder Sidebar runs attacker shortcodes - patch 2.11.0.6

The Situation

Wordfence published CVE-2026-92084 on 2 October 2026 (CVE JSON datePublished 2026-10-03T07:39:17.001Z). The CNA one-liner, verbatim:

The The Beaver Builder Page Builder - Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. Exploitation requires the target site to have a Beaver Builder page containing the Sidebar module populated with a widget that displays attacker-controllable text, such as the core Recent Comments widget, with comment moderation disabled or the attacker's comment approved.

Facts that are on the CVE record, not our lab:

• Product (CNA): beaverbuilder / Beaver Builder Page Builder - Drag and Drop Website Builder, versions 0 lessThanOrEqual 2.11.0.5. Floor is 2.11.0.6.
• WordPress.org slug Wordfence used: beaver-builder-lite-version. wordpress.org API on 5 Oct 2026: stable tag 2.11.0.6, last_updated 2026-09-25 15:09 GMT, 100,000+ active installs.
• CWE-94 code injection.
• CVSS 3.1 9.1 CRITICAL - AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (Wordfence, Primary).
• Finder credit: Samuele Santonicola. Vendor notified 2026-09-15; disclosed 2026-10-02.
• Same 2.11.0.6 drop also closes CVE-2026-95865 (contributor+ blind SQLi via fields[][value] on get_autosuggest_values, CVSS 6.5 Medium, CWE-89, Wordfence PRISM).

Primary sources:

• CVE-2026-92084 / CVE list JSON
• NVD CVE-2026-92084
• Wordfence intel 794e6d9b
• CVE-2026-95865 JSON / Wordfence 1dfb9957
• Fix: WordPress.org changeset 3713226 (sidebar.php) and the matching class-fl-builder-auto-suggest.php change for 95865
• wordpress.org plugin

This is not last month's WordPress core page-template bug (CVE-2026-87902 / GHSA-7hp8-65ch-5whp). Different code, different floor, different inventory command. A site that is already on WP 7.1.2 can still be sitting on Beaver Builder 2.11.0.5.

Version floor

• Affected: Beaver Builder ≤ 2.11.0.5 (CNA: all versions through 2.11.0.5).
• Fixed: 2.11.0.6. wordpress.org shipped it 2026-09-25; Wordfence disclosed the CVEs 2026-10-02.

Check what the site actually runs. Do not trust the Plugins screen badge without reading the version field:

wp plugin list --fields=name,status,version | grep -Ei 'beaver|bb-plugin'
wp plugin get beaver-builder-lite-version --field=version

Anything that prints 2.11.0.5 or lower is still on the vulnerable Sidebar path. If wp plugin get errors, the paid plugin is often a different directory - the plugin list | grep line is the one that tells you the slug.

Patch:

wp plugin update beaver-builder-lite-version
wp plugin get beaver-builder-lite-version --field=version
# expect 2.11.0.6 or newer

Paid / Agency copies are not in the Wordfence CPE. We did not diff Pro against Lite. If the install has a Beaver Builder Sidebar module, treat 2.11.0.6 as the floor until the vendor says otherwise, and update through whatever channel that copy actually uses.

Why this is a shared-hosting problem anyway

The CVSS is 9.1 Critical. Read the vector and the CNA's own preconditions before you paste "unauth RCE" into a customer ticket.

• AV:N / PR:N / UI:N - network, no login, no click. That is why Wordfence scored it Critical.
• The CNA still requires a layout precondition: a Beaver Builder page that contains the Sidebar module, filled with a widget that renders attacker-controlled text. They name core Recent Comments, with comment moderation off or the attacker's comment already approved.
• What the bug is: do_shortcode on that widget output. What it is not, on the CVE text: a guaranteed PHP eval. Impact is whatever shortcodes that site has registered - core, WooCommerce, form plugins, page builders stacked on page builders. We are not ranking those gadgets.
• CISA ADP Vulnrichment on the CVE JSON (updated 2026-10-03T15:14:04.869Z): Exploitation: none, Automatable: yes, Technical Impact: total. That is CISA's SSVC annotation, not a KEV listing.

On a typical cPanel/Plesk WordPress the comment form is public, Recent Comments is a default widget, and agencies drop a Sidebar module onto landing pages without thinking about it. That is the class of site this CVE describes. It is still not "every Beaver Builder install on the internet is RCE." Inventory the plugin version first; then look at whether Sidebar + an attacker-writable widget is actually on a public page.

What the public patch actually changed

We are not publishing a PoC. The fix is a public wordpress.org changeset, so the delta is fair game.

Wordfence cites the vulnerable Sidebar module at modules/sidebar/sidebar.php and modules/sidebar/includes/frontend.php on tag 2.11.0.5, plus do_shortcode call sites in classes/class-fl-builder.php. Changeset 3713226 is the 2.11.0.6 Sidebar fix. The SQLi sibling is the get_autosuggest_values path in class-fl-builder-auto-suggest.php - reachable by a Contributor who owns a draft, because the fl_ajax_update nonce is emitted into the block editor for anyone who can edit a Beaver Builder post type.

If you need to confirm a box picked up the file, compare wp-content/plugins/beaver-builder-lite-version/modules/sidebar/sidebar.php against the 2.11.0.6 tag, not against a blog screenshot.

Honesty

Labeled as such, because this is the part people over-claim:

• Not in CISA KEV as of catalogVersion 2026.10.04 (dateReleased 2026-10-04T18:52:56Z). Today's KEV add was Citrix NetScaler CVE-2026-88779. We are not treating 92084 as "actively exploited" on that list.
• CISA ADP says Exploitation: none as of 3 Oct 2026. We have no Patchstack/CrowdSec volume for this CVE to cite. Absence of a public hunt is not evidence nobody is probing.
• Wordfence 9.1 is vendor-reported CVSS 3.1. NVD had the same 9.1 / AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N when we pulled the record on 5 Oct 2026. No CVSS 4.0 on the CNA container.
• Shortcode execution is not PHP RCE unless a registered shortcode does something that amounts to it. The CNA does not name a specific gadget beyond do_shortcode. Do not write "RCE" on a ticket unless you have site-specific shortcodes that justify it.
• The Sidebar + Recent Comments + unmoderated comments precondition is Wordfence's, not something we reproduced. Sites without that layout are a lower priority for this CVE; they still want 2.11.0.6 for CVE-2026-95865.
• wordpress.org 100,000+ active installs is the lite slug only. Beaver Builder's marketing page says "1 Million+ Websites." That is vendor marketing, not a CVE count.
• Paid plugin versions: unverified against this CPE.

Hunt, then patch

Temporary, not a substitute for 2.11.0.6:

wp option get comment_moderation        # 1 = comments held for review
wp option get default_comment_status    # closed is safer than open

Turn comment moderation on, and pull the Sidebar module off public Beaver Builder pages, while you roll the plugin. Then update.

After 2.11.0.6:

• Confirm the version with wp plugin get, not the panel tile.
• If the site had comments open and a Sidebar module, review recent comments and new users the way you would after any unauthenticated input bug. We are not claiming a compromise indicator unique to this CVE - Wordfence did not publish one.

Fleet grep when you do not have wp-cli in every docroot:

find /home /var/www -type d \( -name beaver-builder-lite-version -o -name bb-plugin \) 2>/dev/null

Read each *.php plugin header Version: line. Anything ≤ 2.11.0.5 goes in the patch window this week.

What this is not

• Not WordPress core CVE-2026-87902 (page-template / PEAR). Different file, different wp core version floor.
• Not the January Beaver Builder contributor RCE (CVE-2025-69319, ≤ 2.9.4.1). If you are still on 2.9.x you have older bugs and this one.
• Not a CISA three-day clock. Patch because the plugin is on 100k+ WP.org installs and the CNA scored it 9.1 with PR:N, not because BOD 26-04 named it.