Security Alert Summary
The BM Content Builder WordPress plugin contains a directory traversal vulnerability that can be reached via the ux_cb_page_customize_save_layout_ajax() function. Authenticated users with Subscriber-level access and above can read arbitrary files on the server, potentially exposing sensitive information.
CVE Details
- CVE ID: CVE-2025-1280
- Affected product: BM Content Builder (vendor: SeaTheme)
- Affected versions: all versions less than 3.17.1 (up to 3.17.1 exclusive)
- Published: September 22, 2026 at 8:16:36 AM UTC
- Last modified: September 22, 2026 at 11:17:23 AM UTC
- CVSS v3.1: Base score 6.5 – MEDIUM; Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Authentication / privileges / interaction: Requires authentication; privileges required: LOW (Subscriber-level access and above); user interaction: NONE
- Primary impact: Confidentiality: HIGH; Integrity: NONE; Availability: NONE
- Weakness (CWE): CWE-22 (Directory Traversal)
Technical Details
The vulnerability is a directory traversal issue present in the BM Content Builder plugin. It is reachable via the ux_cb_page_customize_save_layout_ajax() function, which allows an authenticated user with low privileges to cause the plugin to read files outside of the intended directory. This allows an attacker to obtain the contents of arbitrary files on the server.
The root cause is the lack of proper validation or sanitization of file path input in the named AJAX handler, which permits traversal sequences to reference files outside the intended scope. The impact, as provided, is disclosure of file contents; there is no indication in the provided data of integrity or availability impact.
How This Could Impact Your Website
On a multi-user WordPress site, a contractor or external contributor who has been given a Subscriber or higher account could exploit this vulnerability to read files on the web server. A site owner or internal staff member could find configuration files, backup files, or other sensitive data exposed. Practical consequences include exposure of internal user email addresses, API keys, or other secrets contained in files readable by the web process, which in turn increases the risk of targeted phishing or social engineering against staff or contributors.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially Contributor and Subscriber accounts with write or elevated capabilities.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and access logs for unusual behavior and unauthorized file access attempts.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
