Executive brief
The Builderall Cheetah For Wp plugin is a WordPress page builder tool used to create and manage website layouts. A flaw in the plugin's AJAX handler allows authenticated users with basic subscriber accounts to disable the page builder on any post, including those they don't own, disrupting the website's functionality and content management for administrators and other users.
Technical details
The vulnerability is a privilege escalation flaw caused by missing capability and nonce verification in the wp_ajax_ba_cheetah_disable AJAX handler. The disable() function accepts a post_id parameter directly from user-controlled $_POST data without validating the user's permission to modify that specific post. An authenticated attacker with Subscriber-level access can invoke this AJAX action to set the _ba_cheetah_enabled post meta to false on arbitrary posts. No patch information is currently available in the advisory.
Affected products
- Builderall Cheetah For Wp up to and including 3.0.2
Timeline
- 2026-09-10: disclosed
- 2026-09-10: advisory: CVE-2026-15823 published