In Beaver Builder through 2.5.0.3, attackers can bypass the visibility controls protection mechanism via the REST API.