CVE-2025-1281

HighCVSS 8.8

Published: 22/09/2026(UTC)Updated: 14/10/2026(UTC)Translated: 22/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.57%

46th percentile - higher than 46% of all known CVEs

Summary

The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ux_cb_remove_layout_ajax() and ux_cb_tools_export_ajax() functions in all versions up to, and excluding, 3.17.1. Authenticated attackers with Subscriber-level access and above can delete arbitrary files on the server.

Risk Assessment

Deleting the right file (such as wp-config.php) can easily lead to remote code execution.

Recommendation

Update the BM Content Builder plugin to version 3.17.1 or later.

Other vulnerabilities in BM Content Builder

CVE-2025-1280Medium
The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 (exclusive) via the ux_cb_page_customize_save_layout_ajax() function. This allows authenticated attackers with Subscriber-level access or higher to read arbitrary files on the server, potentially exposing sensitive information.

Original NVD description (English source)

The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ux_cb_remove_layout_ajax() and ux_cb_tools_export_ajax() functions in all versions up to, and excluding, 3.17.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

Vulnerability data from NVD (NIST) · CISA KEV · EPSS