Unauthorized Data Modification Vulnerability in BM Content Builder Plugin for WordPress

CVE-2025-1279

What is CVE-2025-1279?

The BM Content Builder plugin for WordPress is susceptible to a security flaw that allows unauthorized data modification. This stems from the absence of a capability check on the 'ux_cb_tools_import_item_ajax' AJAX action, affecting all versions through 3.16.2.1. Authenticated users with Subscriber-level access or higher are able to exploit this vulnerability to modify arbitrary options on the WordPress site. Attackers can potentially escalate their privileges by altering the default role for user registrations to administrator, thus enabling them to gain unauthorized administrative access.

References