CVE-2025-4102: Beaver Builder Plugin RCE Vulnerability

CVE-2025-4102 Overview

CVE-2025-4102 affects the Beaver Builder Plugin (Starter Version) for WordPress, a widely deployed page builder developed by Fastlinemedia. The plugin fails to validate file types in the save_enabled_icons function across all versions up to and including 2.9.1. Authenticated attackers with Administrator-level access or higher can upload arbitrary files to the affected server. Successful exploitation may lead to remote code execution on the underlying host. The vulnerability is classified under [CWE-434: Unrestricted Upload of File with Dangerous Type]. Fastlinemedia released a partial patch in version 2.9.1, but the issue is not fully resolved at the time of publication.

Critical Impact
Authenticated administrators can upload arbitrary file types via save_enabled_icons, enabling potential remote code execution on the WordPress server.

Affected Products

Fastlinemedia Beaver Builder Plugin (Lite/Starter Version) — all versions up to and including 2.9.1
WordPress sites running the affected plugin component fastlinemedia:beaver_builder
Deployments where untrusted users hold Administrator-level roles

Discovery Timeline

2025-06-20 - CVE-2025-4102 published to the National Vulnerability Database (NVD)
2025-07-11 - Last updated in NVD database

Technical Details for CVE-2025-4102

Vulnerability Analysis

The Beaver Builder Starter plugin exposes a save_enabled_icons function that accepts file uploads without enforcing MIME type or extension restrictions. The function processes uploaded content as part of the icon configuration workflow inside the WordPress admin interface. Because no allowlist of safe file types is applied, an attacker can submit a PHP file or other executable script in place of an icon asset. Once written to a web-accessible directory, the file can be requested directly to trigger server-side execution under the WordPress process context.

The vulnerability requires authentication at the Administrator level, which limits the population of viable attackers. However, multi-tenant WordPress hosting environments, sites using delegated administration, and environments where lower-privileged accounts have been compromised remain exposed. The flaw can be chained with credential theft, phishing, or session hijacking to reach the required privilege tier.

Root Cause

The root cause is missing input validation [CWE-434] in the save_enabled_icons handler. The function trusts user-supplied file content and metadata, omitting checks against WordPress core helpers such as wp_check_filetype_and_ext or extension allowlists. The partial fix in version 2.9.1 reduces but does not eliminate the upload surface.

Attack Vector

The attack vector is network-based and requires an authenticated session with Administrator privileges. An attacker submits a crafted POST request to the plugin's admin endpoint that invokes save_enabled_icons, attaching a file with a server-executable extension. After the file is stored in the uploads directory, the attacker requests the file URL to execute the payload. Successful execution grants code execution at the privileges of the PHP worker process, typically the web server user.

No public proof-of-concept exploit or vendor advisory URL is currently linked in NVD. Technical details are available in the Wordfence Vulnerability Report and the Beaver Builder Changelog.

Detection Methods for CVE-2025-4102

Indicators of Compromise

Unexpected files with executable extensions such as .php, .phtml, or .phar inside the WordPress wp-content/uploads/ directory tree.
Administrator-initiated POST requests to plugin AJAX endpoints invoking the save_enabled_icons action followed by direct GET requests to newly created files.
New scheduled tasks, modified wp-config.php, or unexpected outbound network connections originating from the web server process.

Detection Strategies

Monitor web server access logs for POST requests targeting admin-ajax.php or REST routes associated with Beaver Builder that include save_enabled_icons parameters.
Compare plugin file inventories against known-good baselines to identify foreign files written under plugin or upload directories.
Alert on PHP file creation events under directories that should contain only static media assets.

Monitoring Recommendations

Enable WordPress audit logging for administrator account activity, including plugin configuration changes and media uploads.
Forward web server and PHP-FPM logs to a centralized analytics platform for correlation against authentication events.
Track child processes spawned by the web server user, particularly shell interpreters or outbound network utilities such as curl, wget, or nc.

How to Mitigate CVE-2025-4102

Immediate Actions Required

Update the Beaver Builder Starter plugin to a version newer than 2.9.1 once Fastlinemedia publishes a complete fix; the 2.9.1 release only partially addresses the issue.
Audit Administrator accounts, remove unused privileged users, and rotate credentials for all remaining administrators.
Enforce multi-factor authentication on all WordPress Administrator accounts to reduce the likelihood of credential-based access.

Patch Information

Fastlinemedia released a partial patch in Beaver Builder Starter version 2.9.1. NVD records indicate the fix does not fully remediate the file upload weakness. Administrators should track the Beaver Builder Changelog for a follow-up release that completely resolves CVE-2025-4102 and apply it as soon as it becomes available.

Workarounds

Restrict PHP execution within the wp-content/uploads/ directory using web server configuration to prevent uploaded scripts from running.
Apply a web application firewall (WAF) rule that blocks requests to the save_enabled_icons endpoint containing executable file extensions.
Temporarily disable the Beaver Builder Starter plugin on sites where Administrator role hygiene cannot be guaranteed.

bash

# Apache configuration example: block PHP execution in uploads directory
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar|php[0-9]?)$">
        Require all denied
    </FilesMatch>
</Directory>

# Nginx equivalent
location ~* /wp-content/uploads/.*\.(php|phtml|phar|php[0-9]?)$ {
    deny all;
    return 403;
}