PT-2025-49865 · WordPress · Beaver Builder – Wordpress Page Builder

Athiwat Tiprasaharn · Published 2025-12-09 · Updated 2025-12-15 · CVE-2025-12558

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Beaver Builder – WordPress Page Builder plugin for WordPress versions prior to 2.9.5

Description The Beaver Builder – WordPress Page Builder plugin for WordPress is susceptible to sensitive information disclosure. Authenticated attackers with Contributor-level access or higher can extract sensitive data, including the path and metadata of private attachments, using the get attachment sizes() function. This extracted information can then be used to view the attachments.

Recommendations Update Beaver Builder – WordPress Page Builder plugin for WordPress to version 2.9.5 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-12558

Affected Products

Beaver Builder – Wordpress Page Builder

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-12558 · Security Note
• https://osv.dev/vulnerability/CVE-2025-12558 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/3406987 · Patch
• https://wordfence.com/threat-intel/vulnerabilities/id/eb2f6c67-ef4a-4afc-bd61-6c0185e354a8?source=cve · Note
• https://twitter.com/CVEnew/status/2000617602280788328 · Twitter Post
• https://plugins.trac.wordpress.org/browser/beaver-builder-lite-version/trunk/classes/class-fl-controls.php#L71 · Note
• https://t.me/cveNotify/145483 · Telegram Post
• https://plugins.trac.wordpress.org/browser/beaver-builder-lite-version/trunk/classes/class-fl-controls.php#L216 · Note