WordPress Beaver Builder Lite version 2.9.4.1 contains an Improper Control of Generation of Code flaw identified as CWE‑94. The vulnerability permits an attacker to inject arbitrary PHP code into the plugin’s engine, which is then executed on the web server. This can lead to full compromise of the website's confidentiality, integrity, and availability.

All installations of Beaver Builder Lite from the earliest release up to and including 2.9.4.1 are vulnerable. Sites using the plugin in a WordPress environment with these versions are susceptible until the plugin is updated.

The CVSS score of 7.5 indicates high severity, yet the EPSS value of less than 1% suggests that exploitation is currently uncommon. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires the ability to supply input that reaches the plugin’s code generation mechanism, such as adding or editing custom code widgets via the WordPress admin interface or compromising user credentials. This inference stems from the need to inject code into the plugin’s configuration, a capability typically restricted to administrators or users with elevated privileges. The potential for high‑impact exploitation remains if attackers gain sufficient access.