CVE-2025-1280
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Sep 22, 2026
Vendor
unknown
Description
The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 (exclusive) via the ux_cb_page_customize_save_layout_ajax() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.