EUVD-2025-210985
GHSA-97h8-3g49-xmvg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable AJAX endpoint (AV:N/AC:L), needs only Subscriber login (PR:L), no interaction; arbitrary file read gives C:H with no write or availability impact (I:N/A:N).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
4DescriptionCVE.org
The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 (exclusive) via the ux_cb_page_customize_save_layout_ajax() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
AnalysisAI
Arbitrary file read in BM Content Builder plugin for WordPress versions before 3.17.1 allows authenticated attackers with at least Subscriber-level access to read the contents of files on the server. The flaw is a directory traversal issue in the ux_cb_page_customize_save_layout_ajax() AJAX handler, and it requires only an authenticated request, with no additional user interaction. No public exploit code was identified at time of analysis, and the impact is confidentiality-only, making this a moderate-priority authenticated vulnerability rather than an actively exploited one.
Technical ContextAI
The affected component is a commercial ThemeForest-bundled WordPress plugin, identified by CPE as seatheme:bm_content_builder. The vulnerability is in the ux_cb_page_customize_save_layout_ajax() AJAX action, which is part of the plugin's layout customizer functionality. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, or Path Traversal) indicates that user-supplied path input is not properly sanitized before being used in a file-read operation, allowing an attacker to use sequences such as ../ to escape the intended directory and read arbitrary files. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N confirms that exploitation is network-accessible, requires low privileges (Subscriber-level WordPress authentication in this case), needs no user interaction, and affects confidentiality only. The plugin is often distributed with the Art theme via ThemeForest, which limits its deployment compared with larger WordPress plugin ecosystems but does not eliminate the risk on sites where it is installed.
RemediationAI
Upgrade BM Content Builder to version 3.17.1 or later; this is the vendor-released patch boundary identified by the advisory. If immediate upgrade is not possible, consider temporarily disabling the plugin, which removes the vulnerable ux_cb_page_customize_save_layout_ajax() handler but also disables content builder functionality. Restrict or disable open Subscriber registration and review existing Subscriber accounts to reduce the authenticated attack surface, understanding that this may affect legitimate user onboarding. Deploy WAF rules that block path-traversal sequences such as ../ targeting the vulnerable AJAX action, but be aware that overly broad file-path filtering can cause false positives for legitimate requests. Consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/e96376d3-4d17-4611-bdbf-1bb9c68c0ba4?source=cve for the latest vendor guidance.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today