Beaver Builder CVE-2025-12934

Requires an authenticated WordPress account at Subscriber level or above (per the description and PR:L), which is low-friction on sites that permit open user registration. Target posts must have been originally created with Beaver Builder - posts built with other editors cannot be copied or overwritten, limiting blast radius. The vulnerable handler is named 'duplicate_wpml_layout', strongly suggesting the WPML multilingual integration is involved and possibly required; this is an unconfirmed but important limiting precondition to verify. No user interaction is needed and the request is network-reachable.

CVSS 3.1 base score is 8.1 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, indicating network-reachable exploitation at low attack complexity requiring only low privileges (Subscriber-level per the description) and no user interaction, with high confidentiality and integrity impact but no availability impact. This aligns with CWE-862 (Missing Authorization) - the root cause is a missing capability check on 'duplicate_wpml_layout', not a memory-safety or RCE flaw. Counterbalancing the high CVSS, the EPSS score is low at 0.37% (29th percentile), there is no CISA KEV listing, and no public exploit code is referenced in the provided data, so there is no evidence of active or widespread exploitation. The practical priority is moderate: the low privilege barrier (Subscriber accounts are trivially obtained on sites with open registration) and network vector make it attractive, but impact is bounded to posts originally built with Beaver Builder, and exploitation yields data exposure/modification rather than server takeover. Note the function name 'duplicate_wpml_layout' implies a relationship to the WPML multilingual integration, which may be an unstated precondition - verify with the vendor whether WPML must be active.

An attacker registers or obtains a Subscriber-level account on a WordPress site running a vulnerable Beaver Builder version, then invokes the unprotected 'duplicate_wpml_layout' handler to overwrite a target post with the content of another post. This lets them pull private or password-protected Beaver Builder content into a post they can view, or destroy legitimate content that is not preserved in revisions or backups. No public exploit code is identified at time of analysis, but the low complexity makes a working request straightforward to craft.