PT-2025-49006 · WordPress · Beaver Builder – Wordpress Page Builder

Athiwat Tiprasaharn + 3 · Published 2025-12-04 · Updated 2025-12-04 · CVE-2025-12782

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Beaver Builder – WordPress Page Builder plugin for WordPress versions prior to 2.9.4

Description The Beaver Builder plugin for WordPress is susceptible to an authorization bypass issue. This occurs because the plugin does not adequately verify user authorization within the disable() function. Authenticated attackers with contributor-level access or higher can disable Beaver Builder layouts on any post or page, leading to content integrity problems and layout disruptions.

Recommendations Update the Beaver Builder – WordPress Page Builder plugin to version 2.9.4 or later. As a temporary workaround, consider restricting access to the disable() function until a patch is available.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-12782

Affected Products

Beaver Builder – Wordpress Page Builder

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-12782 · Security Note
• https://plugins.trac.wordpress.org/changeset/3406987/beaver-builder-lite-version · Patch
• https://osv.dev/vulnerability/CVE-2025-12782 · Vendor Advisory
• https://t.me/CVEtracker/38806 · Telegram Post
• https://t.me/cveNotify/144711 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1996485173576097983 · Twitter Post
• https://twitter.com/CVEnew/status/1996473230257684938 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/710ed734-ca98-4ab3-82d5-359e683ee062?source=cve · Note