CVE-2026-15823

The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable() function in versions up to, and including, 3.0.2. The wp_ajax_ba_cheetah_disable AJAX handler is registered without any capability or nonce verification, and the target post_id is sourced directly from user-controlled $_POST['ba_cheetah_data']['post_id']. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disable the page builder layout on arbitrary posts by setting the _ba_cheetah_enabled post meta to false, including on posts owned by other users.

• CWE-862

• https://plugins.trac.wordpress.org/browser/builderall-cheetah-for-wp/tags/3.0.2/classes/class-ba-cheetah-model.php#L208
• https://plugins.trac.wordpress.org/browser/builderall-cheetah-for-wp/tags/3.0.2/classes/class-ba-cheetah-model.php#L334
• https://plugins.trac.wordpress.org/browser/builderall-cheetah-for-wp/tags/3.0.2/classes/class-ba-cheetah-model.php#L462
• https://plugins.trac.wordpress.org/browser/builderall-cheetah-for-wp/tags/3.0.2/classes/class-ba-cheetah-model.php#L692
• https://www.wordfence.com/threat-intel/vulnerabilities/id/374c8bc8-83b1-48d3-877a-f6c8fa2f044b?source=cve

Published

Sep 10, 2026

Last Modified

Sep 11, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-15814Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7…6.5
• CVE-2026-15815Grafana OSS and Grafana Enterprise did not safely resolve sy…8.8
• CVE-2026-15816A flaw was found in dracut. The die() error-handling functio…7.5
• CVE-2026-1582The WP All Export plugin for WordPress is vulnerable to Sens…3.7
• CVE-2026-15820The Builderall for WordPress plugin for WordPress is vulnera…6.4
• CVE-2026-15821The SureDash – Community, Courses & Member Dashboard plugin …6.4
• CVE-2026-15826The User Profile Builder plugin for WordPress is vulnerable …9.8
• CVE-2026-15827The GutenKit Blocks plugin for WordPress is vulnerable to un…5.3
• CVE-2026-15829A SQL injection (CWE-89) and security boundary bypass (CWE-8…8.6
• CVE-2026-15830An issue was discovered in Django 5.2 before 5.2.17 and 6.0 …5.3
• CVE-2026-15831GitLab has remediated an issue in GitLab EE affecting all ve…4.3
• CVE-2026-1584A flaw was found in gnutls. A remote, unauthenticated attack…7.5