The Beaver Builder Plugin (Starter Version) allows authenticated administrators to upload arbitrary files because the 'save_enabled_icons' function does not validate the file type. This flaw can be leveraged to place malicious scripts on the server, enabling remote code execution if an attacker uploads a file that is executable by the web server. The weakness is a classic arbitrary file upload, classified as CWE-434.

WordPress sites running the Beaver Builder Starter Edition (Lite) version 2.9.1 or earlier are affected. The affected products include all releases up to 2.9.1, as listed by the Beaver Builder Team. Hosts must run the plugin in WordPress and have an account with Administrator or higher privileges.

The CVSS score of 7.2 indicates a high severity vulnerability. The EPSS score of 1% shows that exploitation is considered likely but not extremely common. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known active exploits yet. Attackers would need authenticated access at an admin level, but once obtained they could upload and execute files without additional constraints, making this a significant threat for administrators who enable the icon upload feature.