CVE-2025-12558

Name of the Vulnerable Software and Affected Versions Beaver Builder – WordPress Page Builder plugin for WordPress versions prior to 2.9.5

Description The Beaver Builder – WordPress Page Builder plugin for WordPress is susceptible to sensitive information disclosure. Authenticated attackers with Contributor-level access or higher can extract sensitive data, including the path and metadata of private attachments, using the get attachment sizes() function. This extracted information can then be used to view the attachments.

Recommendations Update Beaver Builder – WordPress Page Builder plugin for WordPress to version 2.9.5 or later.