The Beaver Builder – WordPress Page Builder plugin contains a vulnerability in the get_attachment_sizes function that allows authenticated users with Contributor or higher permissions to read the file path and metadata of private attachments, resulting in the disclosure of sensitive media information that can enable an attacker to view private files or infer their location.

WordPress sites that have installed Beaver Builder Page Builder – Drag and Drop Website Builder version 2.9.4 or earlier are affected. The plugin is sold by Fastlinemedia under the Beaver Builder Lite bundle, so all earlier releases prior to 2.9.5 may expose private attachment paths.

The CVSS v3.1 score of 4.3 indicates medium severity, while the EPSS score of less than 1% suggests low likelihood of exploitation. The vulnerability is not listed in CISA KEV, implying no widespread attacks have been reported. Exploitation requires a valid authenticated session with Contributor-level access or higher, so sites that allow contributors to access private media could be at risk of confidential file disclosure.