CVE-2019-25763CWE-288

CVE-2019-25763

Critical · published June 20, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
56.1
In the wild
Unconfirmed
What it is

WordPress Ultimate Addons for Beaver Builder 1.2.4.1 contains an authentication bypass vulnerability that allows attackers to gain unauthorized access by exploiting the social media login form functionality. Attackers can submit a POST request to the admin-ajax.php endpoint with the uabb-lf-google-submit action, a valid administrator email address, and a valid nonce to obtain session cookies and authenticate as that user.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00800 · 56.1th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2026-06-20T18:16Z
References (3)
https://www.exploit-db.com/exploits/47832 · [email protected]https://www.ultimatebeaver.com/ · [email protected]https://www.vulncheck.com/advisories/wordpress-ultimate-addons-for-beaver-builder-authentication-bypass · [email protected]
EPSS history
Timeline
  • 20 JUN 13:36Z
    WordPress Ultimate Addons for Beaver Builder 1.2.4.1 Authentication Bypass
    cvelistv5