CVE-2025-1280

MediumCVSS 6.5

Published: 22/09/2026(UTC)Updated: 14/10/2026(UTC)Translated: 22/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.53%

44th percentile - higher than 44% of all known CVEs

Summary

The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 (exclusive) via the ux_cb_page_customize_save_layout_ajax() function. This allows authenticated attackers with Subscriber-level access or higher to read arbitrary files on the server, potentially exposing sensitive information.

Risk Assessment

An attacker with low privileges can access sensitive server files, such as configurations or credentials, leading to further escalation and data leakage.

Recommendation

Update the BM Content Builder plugin to version 3.17.1 or later to fix the vulnerability.

Other vulnerabilities in BM Content Builder

CVE-2025-1281High
The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ux_cb_remove_layout_ajax() and ux_cb_tools_export_ajax() functions in all versions up to, and excluding, 3.17.1. Authenticated attackers with Subscriber-level access and above can delete arbitrary files on the server.

Original NVD description (English source)

The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 (exclusive) via the ux_cb_page_customize_save_layout_ajax() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS