{"id":"CVE-2025-4102","aliases":["EUVD-2025-27983","GHSA-c4hq-vq7x-9xjf"],"status":"published","title":"Beaver Builder Plugin (Starter Version) \u003c= 2.9.1 - Authenticated (Administrator+) Arbitrary File Upload","description":"The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_enabled_icons' function in all versions up to, and including, 2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability was partially patched in version 2.9.1.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00615,"percentile":0.49766,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-434"],"published":"2025-06-20T11:16:39Z","modified":"2026-06-17T09:32:30Z","products":[{"vendor":"fastlinemedia","product":"beaver_builder"},{"vendor":"the beaver builder team","product":"beaver builder plugin (starter version)"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2eb4608f-fa4f-444c-a857-c9059777a70b?source=cve","tags":["Third Party Advisory"]},{"url":"https://www.wpbeaverbuilder.com/change-logs/?utm_medium=bb-lite\u0026utm_source=repo-readme\u0026utm_campaign=repo-changelog-page","tags":["Product"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4102"},{"url":"https://github.com/advisories/GHSA-c4hq-vq7x-9xjf"}],"sources":{"cve":[{"id":"CVE-2025-4102","title":"Beaver Builder Plugin (Starter Version) \u003c= 2.9.1 - Authenticated (Administrator+) Arbitrary File Upload","description":"The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_enabled_icons' function in all versions up to, and including, 2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability was partially patched in version 2.9.1.","status":"published","published":"2025-06-20T11:16:39.69Z","modified":"2026-04-08T16:44:28.918Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:32:48.512547Z"}],"euvd":[{"id":"EUVD-2025-27983","description":"The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_enabled_icons' function in all versions up to, and including, 2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability was partially patched in version 2.9.1.","status":"published","published":"2025-06-20T11:16:39Z","modified":"2026-04-08T16:44:28Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:25:04.249678Z"}],"ghsa":[{"id":"GHSA-c4hq-vq7x-9xjf","title":"The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to arbitrary file...","description":"The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_enabled_icons' function in all versions up to, and including, 2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability was partially patched in version 2.9.1.","status":"published","published":"2025-06-20T12:30:53Z","modified":"2025-06-20T12:31:04Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:02:46.307418Z"}],"nvd":[{"id":"CVE-2025-4102","description":"The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_enabled_icons' function in all versions up to, and including, 2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability was partially patched in version 2.9.1.","status":"published","published":"2025-06-20T12:15:22.14Z","modified":"2026-06-17T09:32:30.45Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:11:14.091082Z"}]}}