EUVD-2025-210983
GHSA-c2w6-7j98-2vqx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister/obtain Subscriber account
-
DeliveryCall ux_cb_remove_layout_ajax AJAX endpoint
-
ExploitSupply traversal path to wp-config.php
-
ExecutionDelete file forcing WP setup mode
-
PersistReconfigure site to attacker DB
-
ImpactGain admin and execute code
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires (1) a WordPress site running the BM Content Builder plugin at a version below 3.17.1, and (2) an authenticated account at Subscriber level or above (PR:L) - trivially met where user self-registration is enabled, otherwise it requires any existing low-privilege credential. Exploitation targets the ux_cb_remove_layout_ajax() and ux_cb_tools_export_ajax() AJAX handlers over the network with no user interaction. The escalation to RCE is not automatic: it depends on the attacker choosing a critical file such as wp-config.php whose deletion drops WordPress into a reconfigurable setup state. Limiting factors: the low real-world install base of this plugin and the authentication requirement. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw exploitable by any authenticated user at Subscriber level or above with no user interaction - a low privilege bar since Subscriber accounts are self-registerable on many WordPress sites. No EPSS score, CISA KEV entry, POC, or SSVC decision data is present in the input, so probabilistic exploitation likelihood cannot be quantified from these sources. The C:H/I:H/A:H impact rating reflects the escalation chain (arbitrary file deletion → deleting wp-config.php → site takeover → RCE) rather than the raw primitive, which is directly an integrity/availability issue; confidentiality impact is realized only through the takeover chain, making C:H arguably generous for pure file deletion. Net: a genuinely serious, easily-triggered flaw in principle, but real-world priority is tempered by the low deployment footprint of this niche plugin and the requirement for a registered account - treat as a real risk on any exposed site running the plugin with open registration, not a mass-exploitation emergency absent EPSS/KEV signals. |
| Exploit ScenarioDerived | An attacker registers a low-privilege Subscriber account (or uses any existing one) on a WordPress site running BM Content Builder before 3.17.1, then sends a crafted AJAX request to the ux_cb_remove_layout_ajax() or ux_cb_tools_export_ajax() endpoint with a traversal path pointing at wp-config.php. Deleting wp-config.php drops the site into its setup/install state, letting the attacker reconfigure it against an attacker-controlled database, seize admin, and achieve remote code execution. No public exploit code is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Arbitrary file deletion in the BM Content Builder plugin for WordPress (all versions below 3.17.1) allows any authenticated user holding Subscriber-level access or above to delete files of the attacker's choosing from the web server through the plugin's AJAX handlers, with no user interaction required. Because the deletion is unbounded, removing a critical file such as wp-config.php can knock a site into a reconfiguration state and open a practical path to remote code execution, per the reporting vendor. At the time of analysis the issue is not listed in CISA KEV and no public exploit code has been identified; exploitation is gated by the Subscriber-or-above authentication requirement, a low bar on sites that permit self-registration.
RemediationAI
Vendor-released patch: upgrade BM Content Builder to version 3.17.1 or later - via the WordPress Plugins screen or through the Wordfence advisory link (https://www.wordfence.com/threat-intel/vulnerabilities/id/61084da5-fa8d-4fa9-a6a6-6155e9e25fbc?source=cve) if the component was bundled with the 'Art' theme, in which case also update the theme. If an immediate update is impossible, the most effective compensating control is to deactivate the BM Content Builder plugin entirely until it can be patched, accepting loss of its layout/export functionality; if it must stay active, disable or restrict the ux_cb_remove_layout_ajax and ux_cb_tools_export_ajax actions at the web-application-firewall or reverse-proxy layer (blocking or rate-limiting the matching admin-ajax.php action parameter) while noting that broad blocking of admin-ajax.php will break legitimate site functionality, and tighten user registration and role assignment so that self-registered accounts cannot reach Subscriber-level capability (trade-off: blocks legitimate sign-ups). Additionally, keep an offline copy of wp-config.php and other critical configuration files and monitor for their unexpected removal, since restoring a deleted wp-config.php quickly removes the reconfiguration window that can lead to code execution; none of these measures replace upgrading to 3.17.1.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. path traversal): the plugin's ux_cb_remove_layout_ajax() and ux_cb_tools_export_ajax() AJAX actions pass user-supplied path data to file operations without validating that the resolved path stays inside the intended plugin/content directory, so traversal sequences or absolute paths reach the filesystem delete call. The functions are WordPress AJAX handlers reachable over the network through the standard admin-ajax.php endpoint (AV:N, AC:L, UI:N), and their authorization check only requires a logged-in user at Subscriber level or above (PR:L) rather than an administrative capability, which is why the CVSS 3.1 vector scores Confidentiality, Integrity and Availability all High for a base of 8.8. The CPE cpe:2.3:a:seatheme:bm_content_builder:* confirms the affected component is the SeaTheme BM Content Builder plugin, which is distributed through ThemeForest and shipped with the 'Art' WordPress theme for creatives, meaning installations are often theme-bundled rather than tracked as standalone plugin installs.
Know when Bm Content Builder gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network AJAX endpoint reachable by any Subscriber (PR:L, AC:L, UI:N); arbitrary deletion gives I:H/A:H directly and C:H via the wp-config.php site-takeover chain.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ux_cb_remove_layout_ajax() and ux_cb_tools_export_ajax() functions in all versions up to, and excluding, 3.17.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Articles & Coverage 1
Executive ViewAI
The BM Content Builder plugin for WordPress lets an account with only subscriber-level privileges delete arbitrary files from the web server, which can take a site offline and, per the reporting vendor, create a practical route to running attacker-controlled code. Every site running a version below 3.17.1 is affected, and no vendor-released patch has been identified at time of analysis, so exposure persists for as long as the plugin remains installed. Leadership should care because a single low-privilege or self-registered account can escalate into full compromise of the organization's public web properties, with attendant outage, data-loss, and reputational consequences.
No vendor-released patch identified at time of analysis. Interim mitigations: remove or deactivate the BM Content Builder plugin on any site that does not require it; close self-registration and review accounts holding subscriber-level access or above; apply file-integrity monitoring and alerting on wp-config.php and other critical files; maintain verified offline backups and tested restore procedures; block or rate-limit the plugin's AJAX handlers at a WAF or reverse proxy; and restrict write permissions on web-accessible configuration files. Note that the advisory identifies versions below 3.17.1 as affected; no exploit code is publicly identified and the issue is not listed in CISA KEV as of this analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB