Unauthorized Data Modification in Beaver Builder WordPress Page Builder Plugin

CVE-2025-12934

What is CVE-2025-12934?

The Beaver Builder plugin for WordPress is susceptible to unauthorized data manipulation due to a lack of adequate capability checks in the 'duplicate_wpml_layout' function. This vulnerability allows authenticated users, starting from Subscriber-level access, to modify posts created with Beaver Builder. Attackers could replace the content of existing posts with data from other posts, potentially revealing private content and deleting unsaved data. This issue affects all versions of the plugin up to and including 2.9.4.1 and emphasizes the need for tighter security controls to prevent undesirable data modifications.

References