CVE-2025-11726

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11726", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-13T21:41:33.879Z", "datePublished": "2025-12-02T07:24:31.120Z", "dateUpdated": "2026-04-08T17:17:41.566Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:17:41.566Z"}, "affected": [{"vendor": "beaverbuilder", "product": "Beaver Builder Page Builder \u2013 Drag and Drop Website Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.9.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Beaver Builder \u2013 WordPress Page Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.9.4. This is due to insufficient capability checks in the REST API endpoints under the 'fl-controls/v1' namespace that control site-wide Global Presets. This makes it possible for authenticated attackers with contributor-level access and above to add, modify, or delete global color and background presets that affect all Beaver Builder content site-wide."}], "title": "Beaver Builder \u2013 WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Global Preset Modification", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b797e141-a9d2-48c4-a44e-a59a80a90a5b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/beaver-builder-lite-version/trunk/classes/class-fl-controls.php#L53"}, {"url": "https://plugins.trac.wordpress.org/browser/beaver-builder-lite-version/trunk/classes/class-fl-controls.php#L252"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3406987%40beaver-builder-lite-version&new=3406987%40beaver-builder-lite-version&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "timeline": [{"time": "2025-10-13T21:56:50.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-01T18:42:40.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-02T13:57:39.446874Z", "id": "CVE-2025-11726", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-02T13:57:48.616Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11726", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-02T13:57:39.446874Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-02T13:57:44.627Z"}}], "cna": {"title": "Beaver Builder \u2013 WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Global Preset Modification", "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "beaverbuilder", "product": "Beaver Builder Page Builder \u2013 Drag and Drop Website Builder", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.9.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-13T21:56:50.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-01T18:42:40.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b797e141-a9d2-48c4-a44e-a59a80a90a5b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/beaver-builder-lite-version/trunk/classes/class-fl-controls.php#L53"}, {"url": "https://plugins.trac.wordpress.org/browser/beaver-builder-lite-version/trunk/classes/class-fl-controls.php#L252"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3406987%40beaver-builder-lite-version&new=3406987%40beaver-builder-lite-version&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Beaver Builder \u2013 WordPress Page Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.9.4. This is due to insufficient capability checks in the REST API endpoints under the 'fl-controls/v1' namespace that control site-wide Global Presets. This makes it possible for authenticated attackers with contributor-level access and above to add, modify, or delete global color and background presets that affect all Beaver Builder content site-wide."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:17:41.566Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11726", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:17:41.566Z", "dateReserved": "2025-10-13T21:41:33.879Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-02T07:24:31.120Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Beaver Builder Page Builder \u2013 Drag and Drop Website Builder", "vendor": "beaverbuilder", "versions": [{"lessThanOrEqual": "2.9.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fastlinemedia:beaver_builder:*:*:*:*:lite:wordpress:*:*", "matchCriteriaId": "3CC303E8-BD30-4426-8AB7-58F4CA9E9630", "versionEndExcluding": "2.9.4.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Beaver Builder \u2013 WordPress Page Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.9.4. This is due to insufficient capability checks in the REST API endpoints under the 'fl-controls/v1' namespace that control site-wide Global Presets. This makes it possible for authenticated attackers with contributor-level access and above to add, modify, or delete global color and background presets that affect all Beaver Builder content site-wide."}, {"lang": "es", "value": "El plugin Beaver Builder - WordPress Page Builder para WordPress es vulnerable a Autorizaci\u00f3n Faltante en todas las versiones hasta la 2.9.4, inclusive. Esto se debe a comprobaciones de capacidad insuficientes en los endpoints de la API REST bajo el namespace 'fl-controls/v1' que controlan los Ajustes Preestablecidos Globales de todo el sitio. Esto hace posible que atacantes autenticados con acceso de nivel de colaborador y superior puedan a\u00f1adir, modificar o eliminar ajustes preestablecidos globales de color y fondo que afectan a todo el contenido de Beaver Builder en todo el sitio."}], "id": "CVE-2025-11726", "lastModified": "2026-10-18T18:10:00.100", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11726", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-02T13:57:39.446874Z", "version": "2.0.3"}}]}, "published": "2025-12-02T08:15:51.343", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/beaver-builder-lite-version/trunk/classes/class-fl-controls.php#L252"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/beaver-builder-lite-version/trunk/classes/class-fl-controls.php#L53"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3406987%40beaver-builder-lite-version&new=3406987%40beaver-builder-lite-version&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b797e141-a9d2-48c4-a44e-a59a80a90a5b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T01:12:50.489244+00:00", "value": {"mitigation_remediation": ["Update Beaver Builder to the latest version (\u22652.9.5) to apply the vendor fix.", "If an upgrade is not immediately feasible, restrict contributor\u2011level users from accessing the REST API namespace 'fl-controls/v1' or remove the capability that allows them to edit global presets, enforcing proper access control.", "Monitor WordPress REST API logs for unexpected calls to the 'fl-controls/v1' endpoints and remediate promptly."], "summary": {"action": "Update plugin", "impact": "Global preset modification without proper authorization"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Beaver Builder Page Builder \u2013 Drag and Drop Website Builder plugin (lite) on WordPress. All released versions up to and including 2.9.4 are impacted; newer versions are presumed to contain the fix. The issue manifests when the plugin's REST API is exposed and users with contributor or higher roles are authenticated.", "description_and_impact": "The Beaver Builder \u2013 WordPress Page Builder plugin is vulnerable due to missing authorization checks in all REST API endpoints under the 'fl-controls/v1' namespace that manage site\u2011wide Global Presets. Authenticated attackers with contributor-level access or higher can add, modify, or delete global color and background presets that affect every Beaver Builder page on the site. Designers and site owners could therefore alter the appearance of the entire website without proper approval, impacting brand consistency and potentially breaking the visual design. The flaw is a classic example of Missing Authorization, CWE\u2011862.", "risk_and_exploitability": "The CVSS base score of 4.3 reflects a low hazard level, and the EPSS score of less than 1\u202f% indicates a very low likelihood of exploitation at any given time. The flaw is not listed in the CISA KEV catalog. While the attack requires valid user credentials with at least contributor privileges, an attacker who gains such access can modify or delete global presets, potentially compromising the site's design integrity. The attack vector is a REST API call, and the vulnerability hinges on insufficient capability checks."}}}}, "created": "2025-12-04T16:49:06.413128+00:00", "updated": "2026-04-21T01:15:20.136198+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpbeaverbuilder", "wpbeaverbuilder$PRODUCT$beaver_builder"]}