What the vulnerability does
01Description
The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_enabled_icons' function in all versions up to, and including, 2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability was partially patched in version 2.9.1.
Explanation of Vulnerability in Simple Terms
02Summary
Beaver Builder Starter Plugin versions up to 2.9.1 do not properly validate file uploads, allowing administrators to upload malicious files to the site. An attacker with admin access can upload files that may execute code or compromise site integrity. Update to a version newer than 2.9.1 to resolve this issue.
What an attacker can do
03Attacker Capabilities
Upload files without proper validation to execute code or modify site content.
Potential impact on your site
04Site Impact
A compromised admin account can upload malicious files that execute code or alter your site.
Conditions required to exploit
05Prerequisites
Attacker must have administrator-level access to the WordPress site.
Key dates
06Disclosure timeline
June 20, 2025
CVE published
April 8, 2026
Record updated
