The Beaver Builder WordPress plugin fails to verify a user’s authorization when executing the disable() function. An authenticated user with contributor level or higher can therefore arbitrarily disable the Beaver Builder layout on any post or page. This results in loss of layout rendering and potential content integrity problems on those pages.

All installations of the Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress up to and including version 2.9.4. The vulnerable code is present in the Lite version distributed via the WordPress plugin repository.

The CVSS score is 4.3, indicating a moderate impact and low exploitation risk. The EPSS score is below 1 %, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that widespread exploitation is unlikely at present. Nonetheless, because the flaw requires an authenticated account with contributor or higher privileges, any internal user or compromised account could abuse the omission of an authorization check to disrupt page layout. Administrators should treat this as a low‑to‑moderate risk and apply the fix promptly.