Bm Content Builder
Monthly
Arbitrary file read in BM Content Builder plugin for WordPress versions before 3.17.1 allows authenticated attackers with at least Subscriber-level access to read the contents of files on the server. The flaw is a directory traversal issue in the ux_cb_page_customize_save_layout_ajax() AJAX handler, and it requires only an authenticated request, with no additional user interaction. No public exploit code was identified at time of analysis, and the impact is confidentiality-only, making this a moderate-priority authenticated vulnerability rather than an actively exploited one.
Arbitrary file deletion in the BM Content Builder plugin for WordPress (all versions below 3.17.1) allows any authenticated user holding Subscriber-level access or above to delete files of the attacker's choosing from the web server through the plugin's AJAX handlers, with no user interaction required. Because the deletion is unbounded, removing a critical file such as wp-config.php can knock a site into a reconfiguration state and open a practical path to remote code execution, per the reporting vendor. At the time of analysis the issue is not listed in CISA KEV and no public exploit code has been identified; exploitation is gated by the Subscriber-or-above authentication requirement, a low bar on sites that permit self-registration.
Arbitrary file read in BM Content Builder plugin for WordPress versions before 3.17.1 allows authenticated attackers with at least Subscriber-level access to read the contents of files on the server. The flaw is a directory traversal issue in the ux_cb_page_customize_save_layout_ajax() AJAX handler, and it requires only an authenticated request, with no additional user interaction. No public exploit code was identified at time of analysis, and the impact is confidentiality-only, making this a moderate-priority authenticated vulnerability rather than an actively exploited one.
Arbitrary file deletion in the BM Content Builder plugin for WordPress (all versions below 3.17.1) allows any authenticated user holding Subscriber-level access or above to delete files of the attacker's choosing from the web server through the plugin's AJAX handlers, with no user interaction required. Because the deletion is unbounded, removing a critical file such as wp-config.php can knock a site into a reconfiguration state and open a practical path to remote code execution, per the reporting vendor. At the time of analysis the issue is not listed in CISA KEV and no public exploit code has been identified; exploitation is gated by the Subscriber-or-above authentication requirement, a low bar on sites that permit self-registration.