PT-2025-49006 · WordPress · Beaver Builder – Wordpress Page Builder

Athiwat Tiprasaharn + 3 · Publicado 2025-12-04 · Atualizado 2025-12-04 · CVE-2025-12782

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Beaver Builder – WordPress Page Builder plugin for WordPress versions prior to 2.9.4

Description The Beaver Builder plugin for WordPress is susceptible to an authorization bypass issue. This occurs because the plugin does not adequately verify user authorization within the disable() function. Authenticated attackers with contributor-level access or higher can disable Beaver Builder layouts on any post or page, leading to content integrity problems and layout disruptions.

Recommendations Update the Beaver Builder – WordPress Page Builder plugin to version 2.9.4 or later. As a temporary workaround, consider restricting access to the disable() function until a patch is available.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-12782

Produtos afetados

Beaver Builder – Wordpress Page Builder

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-12782 · Nota de Segurança
• https://t.me/CVEtracker/38806 · Publicação no Telegram
• https://t.me/cveNotify/144711 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1996485173576097983 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1996473230257684938 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/710ed734-ca98-4ab3-82d5-359e683ee062?source=cve · Nota
• https://plugins.trac.wordpress.org/changeset/3406987/beaver-builder-lite-version · Correção
• https://osv.dev/vulnerability/CVE-2025-12782 · Aviso do Fabricante