CVE-2025-12558: Fastlinemedia Beaver Builder

Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days.

The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.4 via the 'get_attachment_sizes' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including the path and meta data of private attachments, which can be used to view the attachments.

Affected products

• Fastlinemedia Beaver Builder: before 2.9.4.1 (fixed in 2.9.4.1)

Published 2025-12-09. Last modified 2026-10-07.