CVE-2025-12558

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12558", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-31T17:03:15.524Z", "datePublished": "2025-12-09T13:51:07.203Z", "dateUpdated": "2026-04-08T17:31:10.471Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:31:10.471Z"}, "affected": [{"vendor": "beaverbuilder", "product": "Beaver Builder Page Builder \u2013 Drag and Drop Website Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.9.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Beaver Builder \u2013 WordPress Page Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.4 via the 'get_attachment_sizes' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the path and meta data of private attachments, which can be used to view the attachments."}], "title": "Beaver Builder \u2013 WordPress Page Builder <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eb2f6c67-ef4a-4afc-bd61-6c0185e354a8?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/beaver-builder-lite-version/trunk/classes/class-fl-controls.php#L71"}, {"url": "https://plugins.trac.wordpress.org/browser/beaver-builder-lite-version/trunk/classes/class-fl-controls.php#L216"}, {"url": "https://plugins.trac.wordpress.org/changeset/3406987"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "cweId": "CWE-200", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "timeline": [{"time": "2025-10-31T17:18:34.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-08T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-09T14:15:05.919701Z", "id": "CVE-2025-12558", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-09T14:15:13.367Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12558", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-09T14:15:05.919701Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-09T14:15:09.044Z"}}], "cna": {"title": "Beaver Builder \u2013 WordPress Page Builder <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure", "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "beaverbuilder", "product": "Beaver Builder Page Builder \u2013 Drag and Drop Website Builder", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.9.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-31T17:18:34.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-08T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eb2f6c67-ef4a-4afc-bd61-6c0185e354a8?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/beaver-builder-lite-version/trunk/classes/class-fl-controls.php#L71"}, {"url": "https://plugins.trac.wordpress.org/browser/beaver-builder-lite-version/trunk/classes/class-fl-controls.php#L216"}, {"url": "https://plugins.trac.wordpress.org/changeset/3406987"}], "descriptions": [{"lang": "en", "value": "The Beaver Builder \u2013 WordPress Page Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.4 via the 'get_attachment_sizes' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the path and meta data of private attachments, which can be used to view the attachments."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:31:10.471Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12558", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:31:10.471Z", "dateReserved": "2025-10-31T17:03:15.524Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-09T13:51:07.203Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Beaver Builder Page Builder \u2013 Drag and Drop Website Builder", "vendor": "beaverbuilder", "versions": [{"lessThanOrEqual": "2.9.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fastlinemedia:beaver_builder:*:*:*:*:lite:wordpress:*:*", "matchCriteriaId": "3CC303E8-BD30-4426-8AB7-58F4CA9E9630", "versionEndExcluding": "2.9.4.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Beaver Builder \u2013 WordPress Page Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.4 via the 'get_attachment_sizes' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the path and meta data of private attachments, which can be used to view the attachments."}, {"lang": "es", "value": "El plugin Beaver Builder - WordPress Page Builder para WordPress es vulnerable a la exposici\u00f3n de informaci\u00f3n sensible en todas las versiones hasta la 2.9.4, inclusive, a trav\u00e9s de la funci\u00f3n 'get_attachment_sizes'. Esto permite a atacantes autenticados, con acceso de nivel Colaborador o superior, extraer datos sensibles, incluyendo la ruta y los metadatos de adjuntos privados, que pueden ser utilizados para ver los adjuntos."}], "id": "CVE-2025-12558", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12558", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-09T14:15:05.919701Z", "version": "2.0.3"}}]}, "published": "2025-12-09T16:17:34.243", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/beaver-builder-lite-version/trunk/classes/class-fl-controls.php#L216"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/beaver-builder-lite-version/trunk/classes/class-fl-controls.php#L71"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3406987"}, {"source": "security@wordfence.com", "tags": ["Product", "Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/eb2f6c67-ef4a-4afc-bd61-6c0185e354a8?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security@wordfence.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:17:28.926179+00:00", "value": {"mitigation_remediation": ["Upgrade Beaver Builder to a version newer than 2.9.4, which removes the vulnerable get_attachment_sizes function.", "Restrict Contributor and higher role permissions so that users without a business need cannot access private media, thereby limiting the attack surface.", "Review and tighten file permissions or server configuration to prevent direct access to private attachment URLs outside of the plugin context, such as using .htaccess rules or equivalent server-level controls."], "summary": {"action": "Apply Patch", "impact": "Sensitive Information Exposure"}, "threat_synthesis": {"affected_systems": "WordPress sites that have installed Beaver Builder Page Builder \u2013 Drag and Drop Website Builder version 2.9.4 or earlier are affected. The plugin is sold by Fastlinemedia under the Beaver Builder Lite bundle, so all earlier releases prior to 2.9.5 may expose private attachment paths.", "description_and_impact": "The Beaver Builder \u2013 WordPress Page Builder plugin contains a vulnerability in the get_attachment_sizes function that allows authenticated users with Contributor or higher permissions to read the file path and metadata of private attachments, resulting in the disclosure of sensitive media information that can enable an attacker to view private files or infer their location.", "risk_and_exploitability": "The CVSS v3.1 score of 4.3 indicates medium severity, while the EPSS score of less than 1% suggests low likelihood of exploitation. The vulnerability is not listed in CISA KEV, implying no widespread attacks have been reported. Exploitation requires a valid authenticated session with Contributor-level access or higher, so sites that allow contributors to access private media could be at risk of confidential file disclosure."}}}}, "created": "2025-12-10T17:51:33.766087+00:00", "updated": "2026-04-22T00:30:04.041041+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}