Path Traversal Vulnerability in Post and Page Builder by BoldGrid for WordPress
CVE-2025-0859
6.5MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 6 February 2025
What is CVE-2025-0859?
The Post and Page Builder by BoldGrid, a Visual Drag and Drop Editor plugin for WordPress, is susceptible to a Path Traversal vulnerability affecting all versions up to and including 1.27.6. This flaw arises through the template_via_url() function, allowing authenticated users with Contributor-level access or higher to traverse file paths on the server. Exploiting this vulnerability gives attackers the ability to read arbitrary files, potentially exposing sensitive information stored on the server.
Affected Version(s)
Post and Page Builder by BoldGrid – Visual Drag and Drop Editor * <= 1.27.6