CVE-2025-12782CWE-862broken-access-control

CVE-2025-12782

Medium · published December 4, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
16.6
In the wild
Unconfirmed
What it is

The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.9.4. This is due to the plugin not properly verifying a user's authorization in the disable() function. This makes it possible for authenticated attackers, with contributor level access and above, to disable the Beaver Builder layout on arbitrary posts and pages, causing content integrity issues and layout disruption on those pages.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00259 · 16.6th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-12-04T12:16Z
Affected products (1)
ProductVersionsFixed in
fastlinemedia/beaver_builder< 2.9.4.12.9.4.1
References (2)
https://plugins.trac.wordpress.org/changeset/3406987/beaver-builder-lite-version · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/710ed734-ca98-4ab3-82d5-359e683ee062?source=cve · [email protected]
EPSS history
Timeline
  • 04 DEC 06:48Z
    Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Builder Status Tampering
    cvelistv5