The Beaver Builder plugin contains a missing capability check in the duplicate_wpml_layout function. Authenticated users with a Subscriber role or higher can invoke this function to replace the content of any Beaver Builder post with that of another post. This allows the attacker to expose private or password‑protected information and to delete content that is not preserved in revisions or backups. The flaw directly compromises data integrity and confidentiality of posts created with Beaver Builder.

WordPress sites running any version of the Beaver Builder Page Builder – Drag and Drop Website Builder plugin up to and including 2.9.4.1 are vulnerable. Any post created with Beaver Builder can be duplicated or overwritten by users who have Subscriber-level access or higher.

The CVSS score of 8.1 classifies this issue as high severity, while the EPSS score of less than 1% indicates a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only an authenticated WordPress login with Subscriber or greater privileges; the attacker can trigger the flawed function via the WordPress admin interface without needing elevated system privileges or remote code execution.