CVE-2025-12558
BaseFortify
Publication date: 2025-12-09
Last updated on: 2025-12-11
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| beaver_builder | beaver_builder | * |
| fastlinemedia | beaver_builder | to 2.9.4.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Beaver Builder WordPress plugin allows authenticated users with Contributor-level access or higher to exploit the 'get_attachment_sizes' function to access sensitive information. Specifically, they can extract the path and metadata of private attachments, potentially allowing them to view these attachments even if they should be restricted.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of sensitive information by allowing users with limited access to view private attachments. This could result in exposure of confidential data, potentially harming privacy and security within the affected WordPress site.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows authenticated users with Contributor-level access and above to extract sensitive information such as paths and metadata of private attachments. This exposure of sensitive data could potentially lead to non-compliance with data protection standards and regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information. The subsequent security improvements in version 2.9.4.1, including stricter capability checks and tighter access controls, help mitigate these risks by preventing unauthorized access to sensitive attachment data. [2]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update the Beaver Builder Lite WordPress plugin to version 2.9.4.1 or later, which includes enhanced capability checks restricting access to attachment data and tighter access control to prevent unauthorized data exposure and privilege escalation. [2]