What is the CVSS score of CVE-2025-1281?

CVE-2025-1281 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of BM Content Builder are affected by CVE-2025-1281?

The BM Content Builder plugin for WordPress lets an account with only subscriber-level privileges delete arbitrary files from the web server, which can take a site offline and, per the reporting…. A patch is available.

How to fix or mitigate CVE-2025-1281?

Within 24 hours, inventory every WordPress instance running the BM Content Builder plugin and confirm which are on versions below 3.17.1; where the plugin is not business-critical, deactivate and remove it immediately, and where it must stay live, disable open self-registration and audit all existing subscriber-and-above accounts for anything unexpected. Within 7 days, deploy file-integrity monitoring and alerting on wp-config.php and core WordPress paths, take and verify offline backups of affected sites, and restrict or filter access to the plugin's AJAX endpoints at the web application firewall or reverse proxy; continue monitoring the vendor advisory and apply a fixed release as soon as it is published, noting that 3.17.1 is the remediation threshold indicated by the reporting vendor. Within 30 days, re-scan the estate for any remaining affected installs, tighten user-registration and role-assignment policy permanently, schedule regular plugin inventory and version review, and validate that the site-restore and incident-response runbooks can recover from deleted configuration files so that any recurrence is contained quickly.

BM Content Builder CVE-2025-1281

EUVD-2025-210983 HIGH

Path Traversal (CWE-22)

2026-09-22 Wordfence

GHSA-c2w6-7j98-2vqx

PHP WordPress RCE Path Traversal Bm Content Builder

8.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network AJAX endpoint reachable by any Subscriber (PR:L, AC:L, UI:N); arbitrary deletion gives I:H/A:H directly and C:H via the wp-config.php site-takeover chain.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Sep 22, 2026 - 09:01 EUVD

Analysis Generated

Sep 22, 2026 - 08:38 vuln.today

CVE Published

Sep 22, 2026 - 07:41 nvd

HIGH 8.8

DescriptionCVE.org

The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ux_cb_remove_layout_ajax() and ux_cb_tools_export_ajax() functions in all versions up to, and excluding, 3.17.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

Articles & Coverage 1

News 17 New WordPress Vulnerabilities - 17 High Severity, 2 With POC Sep 23, 2026

AnalysisAI

Arbitrary file deletion in the BM Content Builder plugin for WordPress (all versions below 3.17.1) allows any authenticated user holding Subscriber-level access or above to delete files of the attacker's choosing from the web server through the plugin's AJAX handlers, with no user interaction required. Because the deletion is unbounded, removing a critical file such as wp-config.php can knock a site into a reconfiguration state and open a practical path to remote code execution, per the reporting vendor. At the time of analysis the issue is not listed in CISA KEV and no public exploit code has been identified; exploitation is gated by the Subscriber-or-above authentication requirement, a low bar on sites that permit self-registration.

Technical ContextAI

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, i.e. path traversal): the plugin's ux_cb_remove_layout_ajax() and ux_cb_tools_export_ajax() AJAX actions pass user-supplied path data to file operations without validating that the resolved path stays inside the intended plugin/content directory, so traversal sequences or absolute paths reach the filesystem delete call. The functions are WordPress AJAX handlers reachable over the network through the standard admin-ajax.php endpoint (AV:N, AC:L, UI:N), and their authorization check only requires a logged-in user at Subscriber level or above (PR:L) rather than an administrative capability, which is why the CVSS 3.1 vector scores Confidentiality, Integrity and Availability all High for a base of 8.8. The CPE cpe:2.3:a:seatheme:bm_content_builder:* confirms the affected component is the SeaTheme BM Content Builder plugin, which is distributed through ThemeForest and shipped with the 'Art' WordPress theme for creatives, meaning installations are often theme-bundled rather than tracked as standalone plugin installs.

RemediationAI

Vendor-released patch: upgrade BM Content Builder to version 3.17.1 or later - via the WordPress Plugins screen or through the Wordfence advisory link (https://www.wordfence.com/threat-intel/vulnerabilities/id/61084da5-fa8d-4fa9-a6a6-6155e9e25fbc?source=cve) if the component was bundled with the 'Art' theme, in which case also update the theme. If an immediate update is impossible, the most effective compensating control is to deactivate the BM Content Builder plugin entirely until it can be patched, accepting loss of its layout/export functionality; if it must stay active, disable or restrict the ux_cb_remove_layout_ajax and ux_cb_tools_export_ajax actions at the web-application-firewall or reverse-proxy layer (blocking or rate-limiting the matching admin-ajax.php action parameter) while noting that broad blocking of admin-ajax.php will break legitimate site functionality, and tighten user registration and role assignment so that self-registered accounts cannot reach Subscriber-level capability (trade-off: blocks legitimate sign-ups). Additionally, keep an offline copy of wp-config.php and other critical configuration files and monitor for their unexpected removal, since restoring a deleted wp-config.php quickly removes the reconfiguration window that can lead to code execution; none of these measures replace upgrading to 3.17.1.