Directory Traversal Vulnerability in BM Content Builder Plugin for WordPress

CVE-2025-1280

What is CVE-2025-1280?

The BM Content Builder plugin for WordPress is affected by a directory traversal vulnerability through the ux_cb_page_customize_save_layout_ajax() function. This issue allows authenticated users with Subscriber-level access and above to exploit the vulnerability and access sensitive files on the server, risking the exposure of confidential information. All versions of the plugin prior to 3.17.1 are impacted, highlighting the need for immediate updates or security measures to mitigate potential attacks.

References