High severity · published Jun 20, 2025
CVE-2025-4102
Beaver Builder Plugin (Starter Version) <= 2.9.1 - Authenticated (Administrator+) Arbitrary File Upload
7.2
CVSS
0.6%
EPSS
No
On KEV
Description
The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_enabled_icons' function in all versions up to, and including, 2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability was partially patched in version 2.9.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BB
Beaver Builder Plugin (Starter Version) · The Beaver Builder Team
through 2.9.1 · source: vendor
BB
Beaver Builder · Fastlinemedia
before 2.9.1.1 · source: NVD
Affected product
BB
Beaver Builder Plugin (Starter Version)
The Beaver Builder Team
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-4102
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-4102
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/2eb4608f-fa4f-444c-a857-c9059777a70b?source=cve
Product
https://www.wpbeaverbuilder.com/change-logs/?utm_medium=bb-lite&utm_source=repo-readme&utm_campaign=repo-changelog-page
More from Beaver Builder Plugin (Starter Version)
6.1
CVE-2026-18843
Beaver Builder Plugin (Pro Version) <= 2.11.0.1 - Reflected Cross-Site Scripting via 'no_results_message' node_preview Parameter
5.4
CVE-2025-8427
Beaver Builder Plugin (Starter Version) <= 2.9.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'auto_play'