The Beaver Builder – WordPress Page Builder plugin suffers from a missing capability check in the 'duplicate_wpml_layout' function in all versions up to 2.9.4.1. This vulnerability allows authenticated users with minimal privileges (Subscriber-level and above) to update arbitrary posts by duplicating content from other posts created with Beaver Builder. The flaw can expose private or password-protected content and may result in data loss if content is not saved in revisions or backups. The CVSS 3.1 score is 8.1, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

An attacker with Subscriber-level access can exploit this vulnerability to overwrite arbitrary posts with content from other posts, potentially exposing sensitive private or password-protected data. Additionally, content that is not backed up or saved in revisions may be deleted, causing data loss. The vulnerability does not affect availability but has high impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted users only and monitor for suspicious activity related to post duplication. Avoid granting Subscriber-level or higher privileges to untrusted users. Backup content regularly to mitigate potential data loss.