PT-2025-48650 · WordPress · Beaver Builder – Wordpress Page Builder

Athiwat Tiprasaharn

·

CVE-2025-11726

·

Publicado

2025-12-02

·

Atualizado

2025-12-11

CVSS v3.1

4.3

Média

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Name of the Vulnerable Software and Affected Versions Beaver Builder – WordPress Page Builder plugin versions prior to 2.9.4
Description The Beaver Builder – WordPress Page Builder plugin for WordPress is susceptible to a missing authorization issue. Insufficient capability checks within the REST API endpoints under the 'fl-controls/v1' namespace, which manage site-wide Global Presets, allow authenticated attackers with contributor-level access or higher to add, modify, or delete global color and background presets. These presets impact all Beaver Builder content across the entire site.
Recommendations Update Beaver Builder – WordPress Page Builder plugin to version 2.9.4 or later.

Correção

Missing Authorization

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-11726

Produtos afetados

Beaver Builder – Wordpress Page Builder