PT-2025-18786 · Beaver Builder Team+2 · Beaver Builder Plugin+2

Tom Broucke · Published 2025-05-01 · Updated 2025-07-11 · CVE-2025-4102

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Beaver Builder Plugin (Starter Version) versions prior to 2.9.1

Description: The Beaver Builder Plugin (Starter Version) for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the save enabled icons function. This allows authenticated attackers with Administrator-level access and above to upload arbitrary files to the affected site's server, potentially leading to remote code execution. The vulnerability was partially addressed in version 2.9.1.

Recommendations: Versions prior to 2.9.1: Update to version 2.9.1 or later.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-4102

Affected Products

Beaver Builder Plugin

Beaver-Builder-Lite-Version

Beaver Builder

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-4102 · Security Note
• https://osv.dev/vulnerability/CVE-2025-4102 · Vendor Advisory
• https://twitter.com/gothburz/status/1918059208940912693 · Twitter Post
• https://twitter.com/CVEnew/status/1936110510631797150 · Twitter Post
• https://wpbeaverbuilder.com/change-logs/?utm_medium=bb-lite&utm_source=repo-readme&utm_campaign=repo-changelog-page · Note
• https://twitter.com/attritionorg/status/1921967906184671382 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/2eb4608f-fa4f-444c-a857-c9059777a70b?source=cve · Note
• https://t.me/cvenotify/128519 · Telegram Post