Listen to this Post
The vulnerability CVE-2025-11726 in the Beaver Builder plugin stems from missing authorization checks in its REST API. Specifically, the endpoints under the ‘fl-controls/v1’ namespace that manage global design presets do not verify if a user has the necessary administrative capabilities. This flaw allows any authenticated user with permissions as low as a ‘Contributor’ to interact with these endpoints. Consequently, such users can send crafted HTTP requests to add, modify, or delete site-wide Global Presets. These presets control universal styles like colors and backgrounds, affecting the visual design of all content built with Beaver Builder across the entire website. The issue is a classic case of missing authorization (CWE-862), where the application fails to check privileges before performing a sensitive action.
Platform: Beaver Builder plugin
Version: <= 2.9.4
Vulnerability: Missing Authorization
Severity: Medium
date: 2025-12-02
Prediction: 2025-12-19
What Undercode Say
Analytics
The following Bash command uses `curl` to simulate an unauthorized POST request to the vulnerable REST API endpoint, attempting to modify a global preset.
curl -X POST 'https://target-site.com/wp-json/fl-controls/v1/presets/colors' \
-H 'Authorization: Bearer USER_JWT_TOKEN' \
-H 'Content-Type: application/json' \
-d '{"preset_name":"hacked_preset","values":{"primary":"ff0000"}}'
A simple PHP code snippet that could be used to check if a plugin version is patched by verifying the existence of a proper capability check function.
if ( function_exists('fl_rest_api_verify_capability') ) {
echo 'Patch may be applied.';
} else {
echo 'Vulnerable version likely installed.';
}
How Exploit
1. Attacker gains contributor-level WordPress credentials.
- Attacker obtains a valid REST API authentication token.
3. Attacker identifies the vulnerable endpoint (e.g., `/fl-controls/v1/presets/`).
- Attacker sends crafted POST/PUT/DELETE requests to the endpoint.
- The server processes the request without checking administrative capabilities.
- Global color or background presets are modified or deleted site-wide.
Protection from this CVE
Update the Beaver Builder plugin to a version later than 2.9.4 immediately.
Implement strong role-based access control (RBAC) for all REST API endpoints.
Add mandatory `current_user_can(‘manage_options’)` checks for administrative functions.
Use security plugins to monitor and restrict unusual POST requests to /wp-json/fl-controls/v1/.
Impact
Site-Wide Design Compromise: Attackers can alter global styles, defacing all Beaver Builder content.
Integrity Violation: Unauthorized modification or deletion of critical site preset data.
Privilege Escalation: Users with low-level permissions can perform admin-only actions.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
