Beaver Builder Plugin (Starter Version) Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the Beaver Builder Plugin (Starter Version) for WordPress, affecting all versions through 2.9.1. This issue arises from inadequate file type validation in the 'save_enabled_icons' function, which enables authenticated attackers with Administrator-level access and above to upload arbitrary files to the server. Such uploads could potentially lead to remote code execution.

Impact

Exploitation of this vulnerability could allow for arbitrary file uploads, with the potential for remote code execution, depending on the nature of the uploaded files.

Remediation

Users are advised to update the Beaver Builder Plugin (Starter Version) to version 2.9.1.1 or a newer patched version.