BM Content Builder CVE-2025-1280

Requires an authenticated account with at least Subscriber-level privileges on a WordPress site running BM Content Builder (seatheme) in any version below 3.17.1; the attacker invokes the ux_cb_page_customize_save_layout_ajax() AJAX action with a path-traversal value. Exploitation is limited by that authentication requirement (though Subscriber registration is often open) and by the plugin being a commercial ThemeForest-bundled component with limited deployment. No user interaction beyond the attacker's own authenticated request is needed, and the impact is confidentiality-only (arbitrary file read).

This is a genuine but moderate-priority authenticated flaw, not a high-CVSS-but-low-risk overstatement. The Wordfence-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5) is internally consistent with the description: a network-reachable, low-complexity directory traversal that requires only Subscriber-level authentication (PR:L) and yields high confidentiality impact (C:H) with no integrity or availability impact - matching arbitrary file READ. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so there is no signal of active exploitation or automated weaponization; SSVC framing would put this at exploitation=none, technical impact=partial. The main real-world risk driver is that WordPress sites frequently allow open Subscriber-level registration, lowering the practical bar for the PR:L requirement, and that reading wp-config.php exposes database credentials and secret keys that can seed a broader compromise. Signals are non-conflicting here; the primary limiting factor is the authentication requirement plus the plugin's niche deployment footprint.

An attacker registers or obtains a Subscriber-level account on a WordPress site running BM Content Builder < 3.17.1, then sends a crafted authenticated AJAX request to the ux_cb_page_customize_save_layout_ajax() handler with a traversal path (e.g. ../../../wp-config.php) to read arbitrary server files. The returned file contents can leak database credentials, salts, and API secrets usable to escalate toward full site takeover. No public exploit code was identified at time of analysis.