CVE-2025-11726
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The Beaver Builder – WordPress Page Builder plugin is vulnerable to Missing Authorization in all versions up to, and including, 2.9.4 due to insufficient capability checks in the REST API endpoints under the 'fl-controls/v1' namespace that control site-wide Global Presets. This makes it possible for authenticated attackers with contributor-level access and above to add, modify, or delete global color and background presets that affect all Beaver Builder content site-wide.
Risk Assessment
An attacker with contributor-level access can modify global presets, potentially leading to unauthorized changes in the site's appearance. This may compromise the integrity and visual consistency of the site.
Recommendation
Update the Beaver Builder plugin to the latest version containing the fix. Consider restricting contributor privileges and regularly reviewing preset changes.
Other vulnerabilities in Beaver Builder
See all- CVE-2026-18021Medium
The Beaver Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to and including 2.10.3.1 due to improper validation before running do_shortcode. This allows unauthenticated attackers to execute arbitrary shortcodes.
- CVE-2026-95865Medium
The Beaver Builder plugin for WordPress up to version 2.11.0.5 is vulnerable to blind SQL injection via the 'fields[][value]' parameter. Authenticated attackers with contributor-level access can modify SQL queries and extract sensitive data from the database.
- CVE-2025-12558Medium
The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.4 via the 'get_attachment_sizes' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the path and meta data of private attachments, which can be used to view the attachments.
- CVE-2025-12782Medium
The Beaver Builder – WordPress Page Builder plugin for WordPress in versions up to and including 2.9.4 is vulnerable to authorization bypass. The disable() function does not properly verify a user's authorization, allowing authenticated attackers with contributor-level access and above to disable the Beaver Builder layout on arbitrary posts and pages, causing content integrity issues and layout disruption.
Original NVD description (English source)
The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.9.4. This is due to insufficient capability checks in the REST API endpoints under the 'fl-controls/v1' namespace that control site-wide Global Presets. This makes it possible for authenticated attackers with contributor-level access and above to add, modify, or delete global color and background presets that affect all Beaver Builder content site-wide.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS