CVE Intelligence
Analysis AI-assisted

CVE-2019-25763: Ultimate Addons for Beaver Builder (WordPress) Authentication Bypass via Social Login

CVE-2019-25763 is an authentication bypass in the social media login form of WordPress Ultimate Addons for Beaver Builder 1.2.4.1, as described in the record. The CNA VulnCheck rates it critical with CVSS 3.1 score 9.8 and 4.0 score 9.3. The record shows no KEV listing, no confirmed exploitation in the sources consulted, and no affected or fixed version list.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes an authentication bypass in the social media login form feature of WordPress Ultimate Addons for Beaver Builder, version 1.2.4.1. According to the CNA record, a remote attacker could obtain session cookies and authenticate as an existing user, including an administrator. The vulnerability is classified as CWE-288, Authentication Bypass Using an Alternate Path or Channel. See the VulnCheck advisory and the NVD entry.

Impact

If exploited as described, an attacker could gain administrator-level control of the affected WordPress site, which could allow content tampering, malicious plugin or theme changes, data theft and persistence. The CNA rates confidentiality, integrity and availability impact as high under CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The consequences beyond the site are an inference and are not confirmed by the record.

Affected products and versions

  • Product named in the record: WordPress Ultimate Addons for Beaver Builder.
  • Version explicitly named in the description: 1.2.4.1.
  • The affected product list in the record is empty, so the full range of affected versions is unknown.
  • No fixed version is listed in the record. This does not mean no fix exists; the vendor should be checked directly at Ultimate Beaver.

Exploitation status

The record shows that CISA KEV does not list this CVE, so no active exploitation is confirmed by that source. No confirmed exploitation appears in the sources consulted. The record references a public Exploit-DB entry, which indicates that public material related to this issue exists, but its content is not analyzed here and this does not confirm exploitation in the wild.

Remediation and mitigation

  • Identify whether the Ultimate Addons for Beaver Builder plugin is installed on any WordPress site and which version is in use.
  • Check the vendor site for an updated release and apply it. Because no fixed version appears in the record, confirm the fix status with the vendor before relying on it.
  • If no fix is available, consider disabling the social login feature or removing the plugin until the status is clarified.
  • Review and reduce the number of administrator accounts, and enforce strong authentication for those accounts.
  • After patching or changing configuration, invalidate active sessions for administrator accounts.

Detection guidance

  • Review web server and WordPress logs for requests to admin-ajax.php related to social login features, especially from unfamiliar sources or at unusual volumes.
  • Look for administrator sign-ins from new IP addresses, unusual user agents or times that do not match known staff activity.
  • Audit the user list and role assignments for unexpected administrator accounts or recent privilege changes.
  • Monitor for unexpected plugin, theme or file changes following any suspicious administrator session.

Limitations of the available information

  • The record has no affected version range and no fixed version information.
  • No KEV, EPSS or SSVC data is available in the record.
  • The NVD and CVE.org source pages are listed but their full contents were not reviewed beyond the record.
  • The record status is Deferred, so the information may change.
  • The vendor page is cited for reference only; its current content was not verified in this analysis.

Frequently asked questions

What is CVE-2019-25763?

It is an authentication bypass in the social media login form of WordPress Ultimate Addons for Beaver Builder 1.2.4.1, according to the CNA record. The record links it to CWE-288.

Is this vulnerability being actively exploited?

The record does not show a KEV listing, and no confirmed exploitation appears in the sources consulted. A public Exploit-DB entry is referenced, but that does not confirm exploitation in the wild.

What should administrators do now?

Check whether the plugin is installed and which version is in use, look for a vendor update, and consider disabling the social login feature or removing the plugin if no fix is available. Review administrator accounts and sessions.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.