The Beaver Builder Page Builder plugin for WordPress contains an authorization bypass vulnerability (CWE-862) due to improper authorization checks in the disable() function. This allows authenticated users with contributor or higher privileges to disable the Beaver Builder layout on any post or page, potentially disrupting content presentation. The vulnerability affects all versions up to 2.9.4. The CVSS 3.1 base score is 4.3, reflecting a medium severity with low attack complexity and no user interaction required. No known exploits in the wild have been reported, and no patch or official fix is currently documented.

Exploitation of this vulnerability allows authenticated users with contributor-level access or higher to disable the Beaver Builder layout on arbitrary posts and pages. This results in integrity issues and layout disruption of affected content. There is no direct impact on confidentiality or availability according to the CVSS vector. The disruption could affect website appearance and user experience but does not lead to data disclosure or system compromise based on available information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and monitor for unauthorized layout changes. Avoid granting unnecessary privileges to users who do not require them. Follow the vendor's updates closely for any forthcoming patches or official mitigations.