CVE-2025-4102 is a vulnerability in the Beaver Builder Plugin (Starter Version) for WordPress that arises from unrestricted file upload due to inadequate validation of file types in the 'save_enabled_icons' function. Authenticated attackers with Administrator privileges can upload arbitrary files, potentially enabling remote code execution. The vulnerability affects all versions up to and including 2.9.1, with a partial patch applied in version 2.9.1. No full patch or remediation details are currently available.

Successful exploitation allows an attacker with Administrator-level access to upload arbitrary files to the server hosting the WordPress site. This can lead to remote code execution, compromising confidentiality, integrity, and availability of the affected system. The vulnerability is rated high severity with a CVSS score of 7.2, reflecting its potential impact if exploited.

A partial patch was applied in version 2.9.1 of the Beaver Builder Plugin (Starter Version), but no complete fix or patch link is currently available. Users should monitor the vendor's official channels for updates and apply any forthcoming patches promptly. Until a full fix is released, restrict Administrator access to trusted users only and consider additional security controls to limit file upload capabilities. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.