Beaver Builder WordPress Page Builder Sensitive Information Exposure Vulnerability

A vulnerability allowing sensitive information exposure has been identified in the Beaver Builder WordPress Page Builder plugin, affecting all versions through 2.9.4. The issue arises in the 'get_attachment_sizes' function, where authenticated attackers with Contributor-level access or higher can access private attachment data, including paths and metadata, potentially leading to unauthorized viewing of these attachments.

Impact

Exploitation of this vulnerability allows authenticated users with Contributor-level access and above to access sensitive information, specifically the paths and metadata of private attachments, which could be used to view those attachments.

Remediation

Users can update to Beaver Builder version 2.9.4.1 or a newer patched version to address this vulnerability.