CVE-2025-4102: Beaver Builder Plugin (Starter Version) <= 2.9.1 - Authenticated (Administrator+) Arbitrary File Upload
The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'saveenabledicons' function in all versions up to, and including, 2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability was partially patched in version 2.9.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4102?
CVE-2025-4102 has a high severity rating due to the potential for arbitrary file uploads that can lead to further exploitation.
How do I fix CVE-2025-4102?
To resolve CVE-2025-4102, update the Beaver Builder Plugin (Starter Version) to version 2.9.2 or later where the vulnerability has been patched.
Who is affected by CVE-2025-4102?
CVE-2025-4102 affects users of the Beaver Builder Plugin (Starter Version) on WordPress with versions up to and including 2.9.1.
What type of attacks can be executed due to CVE-2025-4102?
Due to CVE-2025-4102, authenticated attackers can execute arbitrary file uploads, potentially leading to unauthorized access or code execution.
When was CVE-2025-4102 disclosed?
CVE-2025-4102 was disclosed in 2025, highlighting a significant vulnerability in the Beaver Builder Plugin that requires immediate attention.