Missing Authorization Vulnerability in Beaver Builder Page Builder Plugin for WordPress

CVE-2025-11726

What is CVE-2025-11726?

The Beaver Builder Page Builder plugin for WordPress is susceptible to a Missing Authorization flaw. This vulnerability arises from inadequate capability checks within the REST API endpoints located under the 'fl-controls/v1' namespace. As a result, authenticated attackers who possess contributor-level access or higher can exploit this weakness to add, modify, or remove global color and background presets. Such changes can disrupt the visual appearance and coherence of all content created using Beaver Builder throughout the site.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References