Missing Authorization Vulnerability in Beaver Builder Page Builder Plugin for WordPress

CVE-2025-11726

What is CVE-2025-11726?

The Beaver Builder Page Builder plugin for WordPress is susceptible to a Missing Authorization flaw. This vulnerability arises from inadequate capability checks within the REST API endpoints located under the 'fl-controls/v1' namespace. As a result, authenticated attackers who possess contributor-level access or higher can exploit this weakness to add, modify, or remove global color and background presets. Such changes can disrupt the visual appearance and coherence of all content created using Beaver Builder throughout the site.

References