Path Traversal Vulnerability in Post and Page Builder by BoldGrid for WordPress

CVE-2025-0859

Summary

The Post and Page Builder by BoldGrid, a Visual Drag and Drop Editor plugin for WordPress, is susceptible to a Path Traversal vulnerability affecting all versions up to and including 1.27.6. This flaw arises through the template_via_url() function, allowing authenticated users with Contributor-level access or higher to traverse file paths on the server. Exploiting this vulnerability gives attackers the ability to read arbitrary files, potentially exposing sensitive information stored on the server.

References