{"id":"CVE-2026-15823","aliases":["EUVD-2026-75236","GHSA-h65g-px8c-6wr8"],"status":"published","title":"Builderall for WordPress \u003c= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter","description":"The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable() function in versions up to, and including, 3.0.2. The wp_ajax_ba_cheetah_disable AJAX handler is registered without any capability or nonce verification, and the target post_id is sourced directly from user-controlled $_POST['ba_cheetah_data']['post_id']. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disable the page builder layout on arbitrary posts by setting the _ba_cheetah_enabled post meta to false, including on posts owned by other users.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00336,"percentile":0.27244,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-09-10T03:40:40Z","modified":"2026-09-11T21:17:08Z","products":[{"vendor":"builderall","product":"builderall for wordpress"},{"vendor":"unknown","product":"builderall for wordpress"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/374c8bc8-83b1-48d3-877a-f6c8fa2f044b?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/builderall-cheetah-for-wp/tags/3.0.2/classes/class-ba-cheetah-model.php#L692"},{"url":"https://plugins.trac.wordpress.org/browser/builderall-cheetah-for-wp/tags/3.0.2/classes/class-ba-cheetah-model.php#L208"},{"url":"https://plugins.trac.wordpress.org/browser/builderall-cheetah-for-wp/tags/3.0.2/classes/class-ba-cheetah-model.php#L462"},{"url":"https://plugins.trac.wordpress.org/browser/builderall-cheetah-for-wp/tags/3.0.2/classes/class-ba-cheetah-model.php#L334"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15823"},{"url":"https://github.com/advisories/GHSA-h65g-px8c-6wr8"}],"sources":{"cve":[{"id":"CVE-2026-15823","title":"Builderall for WordPress \u003c= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter","description":"The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable() function in versions up to, and including, 3.0.2. The wp_ajax_ba_cheetah_disable AJAX handler is registered without any capability or nonce verification, and the target post_id is sourced directly from user-controlled $_POST['ba_cheetah_data']['post_id']. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disable the page builder layout on arbitrary posts by setting the _ba_cheetah_enabled post meta to false, including on posts owned by other users.","status":"published","published":"2026-09-10T03:40:40.38Z","modified":"2026-09-11T20:19:13.896Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T13:47:51.033687Z"}],"euvd":[{"id":"EUVD-2026-75236","description":"The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable() function in versions up to, and including, 3.0.2. The wp_ajax_ba_cheetah_disable AJAX handler is registered without any capability or nonce verification, and the target post_id is sourced directly from user-controlled $_POST['ba_cheetah_data']['post_id']. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disable the page builder layout on arbitrary posts by setting the _ba_cheetah_enabled post meta to false, including on posts owned by other users.","status":"published","published":"2026-09-10T03:40:40Z","modified":"2026-09-11T20:19:13Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:22.225258Z"}],"ghsa":[{"id":"GHSA-h65g-px8c-6wr8","title":"The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of...","description":"The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable() function in versions up to, and including, 3.0.2. The wp_ajax_ba_cheetah_disable AJAX handler is registered without any capability or nonce verification, and the target post_id is sourced directly from user-controlled $_POST['ba_cheetah_data']['post_id']. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disable the page builder layout on arbitrary posts by setting the _ba_cheetah_enabled post meta to false, including on posts owned by other users.","status":"published","published":"2026-09-10T06:31:43Z","modified":"2026-09-10T06:31:43Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:11:40.819612Z"}],"nvd":[{"id":"CVE-2026-15823","description":"The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable() function in versions up to, and including, 3.0.2. The wp_ajax_ba_cheetah_disable AJAX handler is registered without any capability or nonce verification, and the target post_id is sourced directly from user-controlled $_POST['ba_cheetah_data']['post_id']. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disable the page builder layout on arbitrary posts by setting the _ba_cheetah_enabled post meta to false, including on posts owned by other users.","status":"published","published":"2026-09-10T04:17:48.28Z","modified":"2026-09-11T21:17:08.513Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:45.93749Z"}]}}