The Beaver Builder – WordPress Page Builder plugin is vulnerable due to missing authorization checks in all REST API endpoints under the 'fl-controls/v1' namespace that manage site‑wide Global Presets. Authenticated attackers with contributor-level access or higher can add, modify, or delete global color and background presets that affect every Beaver Builder page on the site. Designers and site owners could therefore alter the appearance of the entire website without proper approval, impacting brand consistency and potentially breaking the visual design. The flaw is a classic example of Missing Authorization, CWE‑862.

The vulnerability affects the Beaver Builder Page Builder – Drag and Drop Website Builder plugin (lite) on WordPress. All released versions up to and including 2.9.4 are impacted; newer versions are presumed to contain the fix. The issue manifests when the plugin's REST API is exposed and users with contributor or higher roles are authenticated.

The CVSS base score of 4.3 reflects a low hazard level, and the EPSS score of less than 1 % indicates a very low likelihood of exploitation at any given time. The flaw is not listed in the CISA KEV catalog. While the attack requires valid user credentials with at least contributor privileges, an attacker who gains such access can modify or delete global presets, potentially compromising the site's design integrity. The attack vector is a REST API call, and the vulnerability hinges on insufficient capability checks.