Beaver Builder EUVD-2025-27983

While the CVSS 3.1 score of 7.2 (High) indicates significant severity, real-world risk assessment requires additional context: The attack vector is Network (AV:N) and complexity is Low (AC:L), making exploitation straightforward. However, Privilege Required is High (PR:H), limiting the attacker pool to Administrator-level accounts. This is a critical constraint—legitimate WordPress administrators already possess file upload and code execution capabilities through native WordPress functions, reducing the practical threat from compromised or malicious admins. The 'partially patched' status in 2.9.1 is concerning and suggests EPSS (Exploitation Probability Scoring System) may be elevated due to patch bypass potential. KEV (CISA Known Exploited Vulnerabilities) status is unknown from provided data but should be verified. Without public POC availability, exploitation requires WordPress admin access, limiting mass-exploitation risk. Using SSVC framework: exploitation likelihood is Low-to-Moderate (privileged access required), technical impact is High (RCE possible), and automatable impact is Limited (admin interaction required). Real-world priority depends on WordPress deployment security posture—high-trust environments have lower risk; multi-admin or compromised-credential scenarios elevate risk significantly.

A WordPress administrator account is compromised through credential theft or a phishing attack. The attacker logs into the WordPress admin panel and navigates to the Beaver Builder settings where the 'save_enabled_icons' function accepts file uploads. The attacker bypasses client-side validation and uploads a malicious PHP file (e.g., shell.php) disguised or with a double extension (shell.php.jpg). Due to missing server-side file type validation in 'save_enabled_icons', the file is stored in the uploads directory with execute permissions. The attacker then accesses the uploaded PHP file via HTTP request (e.g., /wp-content/uploads/shell.php), triggering PHP execution on the server and achieving remote code execution with web server privileges. From this foothold, the attacker can establish persistence, exfiltrate data, pivot to internal systems, or launch further attacks. The attack assumes admin-level access, limiting the threat to scenarios involving credential compromise, supply chain attacks on hosting providers, or malicious plugins/developers with admin roles. The partial patch in 2.9.1 suggests the vulnerability may be exploitable through techniques such as MIME type spoofing or extension-based bypass, requiring verification of the complete fix in 2.9.2+.