CVE-2026-18021 is a code injection vulnerability in the Beaver Builder Page Builder – Drag and Drop Website Builder WordPress plugin. The flaw arises because the plugin does not properly validate input before executing do_shortcode, enabling unauthenticated attackers to execute arbitrary shortcodes. This vulnerability affects all versions up to and including 2.10.3.1. The CVSS v3.1 base score is 6.5, indicating a medium severity level with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity but not availability.

An unauthenticated attacker can execute arbitrary shortcodes on a vulnerable WordPress site using the affected plugin. This can lead to partial compromise of confidentiality and integrity of the site content or functionality. There is no indication of impact on availability. No known exploits are reported in the wild at this time.

No official patch or remediation has been confirmed or published by the vendor as of the current information. Users should monitor the vendor's advisory channels for updates and apply any official fixes once available. Until then, consider restricting access to the plugin's shortcode execution functionality or disabling the plugin if feasible to reduce exposure.