Beaver Builder WordPress Page Builder Missing Authorization Vulnerability in REST API Endpoints

A missing authorization vulnerability has been identified in the Beaver Builder WordPress Page Builder plugin, affecting all versions through 2.9.4. The issue arises from inadequate capability checks in the REST API endpoints under the 'fl-controls/v1' namespace, which manage site-wide Global Presets. This vulnerability allows authenticated attackers with contributor-level access and above to add, modify, or delete global color and background presets, impacting all Beaver Builder content across the site.

Impact

Exploitation of this vulnerability allows for unauthorized modification of global color and background presets, which can disrupt the appearance and consistency of Beaver Builder content site-wide.

Remediation

Users can update to version 2.9.4.1 or a newer patched version to address this vulnerability.