CVE-2025-12782

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12782", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-05T22:08:55.570Z", "datePublished": "2025-12-04T06:48:39.973Z", "dateUpdated": "2026-04-08T17:00:31.161Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:00:31.161Z"}, "affected": [{"vendor": "beaverbuilder", "product": "Beaver Builder Page Builder \u2013 Drag and Drop Website Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.9.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Beaver Builder \u2013 WordPress Page Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.9.4. This is due to the plugin not properly verifying a user's authorization in the disable() function. This makes it possible for authenticated attackers, with contributor level access and above, to disable the Beaver Builder layout on arbitrary posts and pages, causing content integrity issues and layout disruption on those pages."}], "title": "Beaver Builder \u2013 WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Builder Status Tampering", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/710ed734-ca98-4ab3-82d5-359e683ee062?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3406987/beaver-builder-lite-version"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}, {"lang": "en", "type": "finder", "value": "Itthidej Aramsri"}, {"lang": "en", "type": "finder", "value": "Powpy"}, {"lang": "en", "type": "finder", "value": "Waris Damkham"}], "timeline": [{"time": "2025-10-28T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-11-05T22:25:17.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-03T18:08:15.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-05T17:21:21.671347Z", "id": "CVE-2025-12782", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-05T17:21:27.871Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12782", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-05T17:21:21.671347Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-05T17:21:24.952Z"}}], "cna": {"title": "Beaver Builder \u2013 WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Builder Status Tampering", "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}, {"lang": "en", "type": "finder", "value": "Itthidej Aramsri"}, {"lang": "en", "type": "finder", "value": "Powpy"}, {"lang": "en", "type": "finder", "value": "Waris Damkham"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "beaverbuilder", "product": "Beaver Builder Page Builder \u2013 Drag and Drop Website Builder", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.9.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-28T00:00:00.000+00:00", "value": "Discovered"}, {"lang": "en", "time": "2025-11-05T22:25:17.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-03T18:08:15.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/710ed734-ca98-4ab3-82d5-359e683ee062?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3406987/beaver-builder-lite-version"}], "descriptions": [{"lang": "en", "value": "The Beaver Builder \u2013 WordPress Page Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.9.4. This is due to the plugin not properly verifying a user's authorization in the disable() function. This makes it possible for authenticated attackers, with contributor level access and above, to disable the Beaver Builder layout on arbitrary posts and pages, causing content integrity issues and layout disruption on those pages."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-12-04T06:48:39.973Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12782", "state": "PUBLISHED", "dateUpdated": "2025-12-05T17:21:27.871Z", "dateReserved": "2025-11-05T22:08:55.570Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-04T06:48:39.973Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Beaver Builder Page Builder \u2013 Drag and Drop Website Builder", "vendor": "beaverbuilder", "versions": [{"lessThanOrEqual": "2.9.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fastlinemedia:beaver_builder:*:*:*:*:lite:wordpress:*:*", "matchCriteriaId": "3CC303E8-BD30-4426-8AB7-58F4CA9E9630", "versionEndExcluding": "2.9.4.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Beaver Builder \u2013 WordPress Page Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.9.4. This is due to the plugin not properly verifying a user's authorization in the disable() function. This makes it possible for authenticated attackers, with contributor level access and above, to disable the Beaver Builder layout on arbitrary posts and pages, causing content integrity issues and layout disruption on those pages."}, {"lang": "es", "value": "El plugin Beaver Builder - WordPress Page Builder para WordPress es vulnerable a una omisi\u00f3n de autorizaci\u00f3n en todas las versiones hasta la 2.9.4, inclusive. Esto se debe a que el plugin no verifica correctamente la autorizaci\u00f3n de un usuario en la funci\u00f3n disable(). Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador y superior, deshabiliten el dise\u00f1o de Beaver Builder en publicaciones y p\u00e1ginas arbitrarias, causando problemas de integridad del contenido e interrupci\u00f3n del dise\u00f1o en esas p\u00e1ginas."}], "id": "CVE-2025-12782", "lastModified": "2026-10-18T17:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12782", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-05T17:21:21.671347Z", "version": "2.0.3"}}]}, "published": "2025-12-04T07:16:13.883", "references": [{"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3406987/beaver-builder-lite-version"}, {"source": "security@wordfence.com", "tags": ["Product", "Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/710ed734-ca98-4ab3-82d5-359e683ee062?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T17:48:23.826119+00:00", "value": {"mitigation_remediation": ["Update Beaver Builder to version\u202f2.9.5 or later.", "If an update is not feasible, remove contributor level or higher privileges from users who should not be able to modify Beaver Builder layout settings.", "Monitor WordPress logs for attempts to disable Beaver Builder layout on posts and pages and investigate any unauthorized activity."], "summary": {"action": "Patch immediately", "impact": "Authorization bypass allowing content tampering"}, "threat_synthesis": {"affected_systems": "All installations of the Beaver Builder Page Builder \u2013 Drag and Drop Website Builder plugin for WordPress up to and including version\u202f2.9.4. The vulnerable code is present in the Lite version distributed via the WordPress plugin repository.", "description_and_impact": "The Beaver Builder WordPress plugin fails to verify a user\u2019s authorization when executing the disable() function. An authenticated user with contributor level or higher can therefore arbitrarily disable the Beaver Builder layout on any post or page. This results in loss of layout rendering and potential content integrity problems on those pages.", "risk_and_exploitability": "The CVSS score is 4.3, indicating a moderate impact and low exploitation risk. The EPSS score is below 1\u202f%, and the vulnerability is not listed in CISA\u2019s KEV catalog, suggesting that widespread exploitation is unlikely at present. Nonetheless, because the flaw requires an authenticated account with contributor or higher privileges, any internal user or compromised account could abuse the omission of an authorization check to disrupt page layout. Administrators should treat this as a low\u2011to\u2011moderate risk and apply the fix promptly."}}}}, "created": "2025-12-04T16:43:49.377410+00:00", "updated": "2026-04-21T18:00:11.706828+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}