Arbitrary File Deletion Vulnerability in BM Content Builder Plugin for WordPress

CVE-2025-1281

What is CVE-2025-1281?

The BM Content Builder plugin for WordPress is susceptible to arbitrary file deletion due to inadequate file path validation in certain functions. This vulnerability affects all versions up to and excluding 3.17.1. Authenticated users with at least Subscriber-level access can exploit this weakness to delete arbitrary files on the server, which could lead to severe consequences such as unauthorized remote code execution if critical files, like wp-config.php, are removed.

References