The Beaver Builder Page Builder plugin for WordPress contains a sensitive information exposure vulnerability (CWE-200) in all versions up to 2.9.4. Authenticated attackers with Contributor-level permissions or above can exploit the 'get_attachment_sizes' function to retrieve sensitive data such as file paths and metadata of private attachments. This information disclosure could allow unauthorized access to private attachments. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required. No known exploits are reported in the wild. The vulnerability is specific to the plugin and does not affect cloud services.

The vulnerability allows unauthorized disclosure of sensitive information related to private attachments within WordPress sites using the affected Beaver Builder plugin versions. Attackers with Contributor-level access can obtain file paths and metadata, which may lead to unauthorized viewing of private attachments. There is no impact on system integrity or availability. The exposure is limited to authenticated users with certain privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and monitor for suspicious activity related to attachment access. Avoid granting Contributor or higher privileges to untrusted users. Review plugin updates regularly for any forthcoming patches addressing this issue.