CVE-2025-11726: Beaver Builder Auth Bypass Vulnerability

CVE-2025-11726 Overview

CVE-2025-11726 is a Missing Authorization vulnerability (CWE-862) affecting the Beaver Builder WordPress Page Builder plugin. The vulnerability exists in all versions up to and including 2.9.4 due to insufficient capability checks in the REST API endpoints under the fl-controls/v1 namespace that control site-wide Global Presets. This security flaw allows authenticated attackers with contributor-level access and above to add, modify, or delete global color and background presets that affect all Beaver Builder content site-wide.

Critical Impact

Authenticated attackers with low-privilege contributor accounts can manipulate site-wide visual elements, potentially defacing websites or disrupting business operations across all pages using Beaver Builder.

Affected Products

• Fastlinemedia Beaver Builder (Lite version) up to and including version 2.9.4
• Beaver Builder WordPress Page Builder plugin for WordPress
• All WordPress installations using vulnerable Beaver Builder versions

Discovery Timeline

• 2025-12-02 - CVE-2025-11726 published to NVD
• 2025-12-11 - Last updated in NVD database

Technical Details for CVE-2025-11726

Vulnerability Analysis

The vulnerability resides in the class-fl-controls.php file within the Beaver Builder plugin. Specifically, the REST API endpoints registered under the fl-controls/v1 namespace lack proper authorization checks before allowing modifications to Global Presets. The CVSS 3.1 score of 4.3 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N indicates this is a network-exploitable vulnerability requiring low privileges with no user interaction needed.

The vulnerability affects the integrity of site-wide design settings without impacting confidentiality or availability directly. The EPSS (Exploit Prediction Scoring System) probability is 0.031% (8.244 percentile), suggesting relatively low likelihood of exploitation in the wild.

Root Cause

The root cause is insufficient capability checks in the REST API permission callbacks. The affected code in class-fl-controls.php (specifically around lines 53 and 252 based on the referenced source code) fails to properly verify that the requesting user has administrative privileges before allowing modifications to Global Presets. Instead of requiring administrator capabilities, the endpoint accepts requests from any authenticated user with contributor-level permissions or higher.

This is a classic Missing Authorization vulnerability where the application assumes authentication alone is sufficient without implementing proper role-based access control for sensitive administrative functions.

Attack Vector

The attack vector is network-based (AV:N) with low attack complexity (AC:L). An attacker needs:

1. An authenticated session with at least contributor-level privileges on the target WordPress site
2. Knowledge of the fl-controls/v1 REST API namespace endpoints
3. Ability to craft REST API requests to add, modify, or delete Global Presets

The attacker can send malicious REST API requests to the vulnerable endpoints to manipulate global color schemes and background presets. These changes propagate site-wide, affecting all content built with Beaver Builder. The attack requires no user interaction and the scope is unchanged, meaning the impact is limited to the vulnerable component itself.

Detection Methods for CVE-2025-11726

Indicators of Compromise

• Unexpected changes to site-wide color schemes or background presets in Beaver Builder
• REST API access logs showing unusual requests to fl-controls/v1 endpoints from non-administrator users
• WordPress audit logs indicating Global Preset modifications by contributor-level accounts
• Visual inconsistencies across Beaver Builder pages that administrators did not authorize

Detection Strategies

Organizations should implement monitoring for REST API activity, particularly focusing on:

1. API Request Monitoring: Track all requests to the fl-controls/v1 namespace and correlate them with user privilege levels
2. User Activity Auditing: Enable comprehensive WordPress audit logging to track which users are modifying Global Presets
3. Change Detection: Implement file integrity monitoring and database change detection to identify unauthorized preset modifications
4. Behavioral Analysis: Flag contributor-level users attempting to access administrative REST API endpoints

Monitoring Recommendations

Security teams should configure their WordPress security plugins or SIEM solutions to alert on REST API calls to Beaver Builder control endpoints from users without administrative privileges. Additionally, implementing a Web Application Firewall (WAF) rule to monitor and potentially block suspicious fl-controls/v1 API traffic from non-admin users can provide an additional layer of defense.

How to Mitigate CVE-2025-11726

Immediate Actions Required

• Update Beaver Builder plugin to a version newer than 2.9.4 immediately
• Audit all contributor-level and above user accounts for legitimacy
• Review Global Presets for any unauthorized changes and restore from backup if necessary
• Consider temporarily restricting contributor-level access until the patch is applied

Patch Information

A patch is available through the official WordPress plugin repository. The security fix can be reviewed at the official changeset URL referenced in the vulnerability disclosure. The patch adds proper capability checks to the REST API endpoints in class-fl-controls.php to ensure only users with appropriate administrative privileges can modify Global Presets.

Organizations should update via the WordPress admin dashboard (Plugins → Installed Plugins → Update) or through WP-CLI for automated deployment environments. The Wordfence threat intelligence advisory provides additional context at the referenced third-party advisory URL.

Workarounds

If immediate patching is not possible, organizations can implement the following temporary mitigations:

1. Restrict User Privileges: Temporarily demote contributor-level users to subscriber level or disable accounts until the patch is applied
2. REST API Restrictions: Use a WordPress security plugin to restrict access to the fl-controls/v1 REST API namespace to administrators only
3. WAF Rules: Implement Web Application Firewall rules to block non-admin REST API requests to Beaver Builder control endpoints

For temporary REST API protection, consider adding capability restrictions through WordPress filters or using security plugins that allow granular REST API access control. However, these workarounds are not substitutes for applying the official patch.