Beaver Builder CVE-2025-12558

Requires an authenticated WordPress account with at least Contributor-level privileges on a site running the Beaver Builder (lite) plugin version 2.9.4 or earlier; the attacker then abuses the 'get_attachment_sizes' function to read paths and metadata of private attachments. Limiting factors: exploitation is impossible for fully unauthenticated visitors (PR:L), impact is restricted to disclosure of private attachment paths/metadata rather than arbitrary content or site compromise, and sites that do not grant untrusted users Contributor+ roles face substantially reduced real-world exposure.

This is a genuine but low-priority issue. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3 MEDIUM) describes a network-reachable, low-complexity flaw requiring Contributor-level authentication (PR:L) with no user interaction, limited confidentiality impact and no integrity or availability impact - consistent with the CWE-200 information-exposure classification and the description, which states authenticated Contributor+ users can extract paths and metadata of private attachments. All signals point the same direction and reinforce low urgency: EPSS is 0.41% (33rd percentile), there is no CISA KEV listing (not actively exploited), and no public exploit code is referenced. No SSVC decision data was provided in the input. The main caveat is that the required privilege (Contributor) is a relatively low bar on multi-author WordPress sites, so the barrier is authentication rather than administrative trust; however, impact is confined to disclosure of private attachment paths/metadata, not full content compromise or code execution. The CVSS and the description are mutually consistent - network vector matches the WordPress HTTP/AJAX interface and PR:L matches the stated Contributor requirement - so no conflict needs vendor verification.

An attacker who holds or obtains a low-privilege Contributor account on a WordPress site running Beaver Builder (≤2.9.4) invokes the plugin's 'get_attachment_sizes' function to enumerate file paths and metadata of private media attachments they should not be able to see, then uses those disclosed paths to view the private attachments. No public exploit code was identified at time of analysis, and the low complexity means it would be straightforward to script once the endpoint is known.