CVE-2025-11726: 
WordPress vulnerability analysis and mitigation

CVE-2025-11726 is a Missing Authorization vulnerability in the Beaver Builder – WordPress Page Builder plugin (lite version) that allows authenticated attackers with contributor-level access or above to manipulate site-wide Global Presets. All versions up to and including 2.9.4 are affected; the issue was disclosed on December 2, 2025, and patched in version 2.9.4.1. It carries a CVSS v3.1 base score of 4.3 (Medium) (Red Hat CVE, Wordfence).

The root cause is insufficient capability checks (CWE-862: Missing Authorization) on REST API endpoints registered under the fl-controls/v1 namespace within the class-fl-controls.php file. Specifically, the endpoints at lines 53 and 252 of that class do not properly verify whether the requesting user has the privileges required to modify global design presets. Any authenticated WordPress user with at least contributor-level access can send crafted REST API requests to add, modify, or delete global color and background presets that apply site-wide to all Beaver Builder content (Wordfence, WordPress Trac).

Successful exploitation allows authenticated low-privilege users (contributors and above) to alter site-wide design presets — including global color schemes and background configurations — affecting all pages built with Beaver Builder. This can result in unauthorized visual modifications and site-wide design disruptions, degrading the integrity and appearance of the entire website. There is no confidentiality or availability impact, and the scope is limited to the affected WordPress installation (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code has been observed, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.026%, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid WordPress account with at least contributor-level access, limiting the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Obtain contributor-level access: Register or compromise a WordPress account with at least contributor-level privileges on the target site running Beaver Builder ≤ 2.9.4.
2. Identify the REST API endpoint: Enumerate the fl-controls/v1 REST API namespace (e.g., via GET /wp-json/fl-controls/v1/) to discover available endpoints for managing Global Presets.
3. Craft a malicious REST API request: Send an authenticated HTTP POST or PUT request to the relevant fl-controls/v1 endpoint (e.g., for color or background presets), including a modified or malicious preset payload in the request body.
4. Modify or delete global presets: Because capability checks are absent, the server accepts the request and applies the changes site-wide, altering the visual appearance of all Beaver Builder-built pages across the WordPress site (Wordfence, WordPress Trac).

• Network: Unexpected authenticated REST API requests to endpoints under /wp-json/fl-controls/v1/ originating from contributor-level user accounts, particularly POST/PUT/DELETE methods.
• Logs: WordPress access logs showing REST API calls to fl-controls/v1 endpoints from accounts that do not normally interact with design settings; repeated or bulk modifications in a short timeframe.
• Application: Unexplained changes to site-wide global color or background presets in Beaver Builder settings, especially if no administrator made those changes.

Update the Beaver Builder – WordPress Page Builder (lite) plugin to version 2.9.4.1 or later, which introduces proper capability checks on the affected REST API endpoints (WordPress Trac). As interim measures, administrators should audit and restrict contributor-level user accounts, monitor for unexpected changes to global design presets, and consider disabling REST API access for lower-privilege roles if not required. Regularly reviewing plugin configurations and user permissions is recommended as a general hardening practice (Wordfence).

The vulnerability was covered in Sucuri's December 2025 vulnerability patch roundup, noting it as part of a broader set of WordPress plugin issues addressed that month (Sucuri Blog). Community reaction has been minimal given the medium severity and lack of public exploit code; no significant vendor statements or notable researcher commentary beyond the Wordfence disclosure have been identified.