Arbitrary File Upload Vulnerability in Beaver Builder Plugin for WordPress
CVE-2025-4102

7.2HIGH

Key Information:

Vendor

WordPress
Status
Beaver Builder Plugin (starter Version)
Vendor
CVE Published:
20 June 2025

What is CVE-2025-4102?

The Beaver Builder Plugin (Starter Version) for WordPress has a vulnerability that allows authenticated users with Administrator-level access and above to upload arbitrary files to the server due to insufficient file type validation in the 'save_enabled_icons' function. This flaw persists in all versions up to and including 2.9.1. If exploited, this vulnerability could lead to remote code execution, enabling attackers to gain control over the affected site. A partial patch was released in version 2.9.1 to mitigate this risk.

Affected Version(s)

Beaver Builder Plugin (Starter Version) * <= 2.9.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://www.wpbeaverbuilder.com/change-logs/?utm_medium=b...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tom Broucke
.
CVE-2025-4102 : Arbitrary File Upload Vulnerability in Beaver Builder Plugin for WordPress