CVE-2025-1280

MEDIUM 6.5

BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Read

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 (exclusive) via the ux_cb_page_customize_save_layout_ajax() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

CWE	CWE-22
Vendor	seatheme
Product	bm content builder
Published	Sep 22, 2026

Stay Ahead of the Next One

Get instant alerts for seatheme bm content builder

Be the first to know when new medium vulnerabilities affecting seatheme bm content builder are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

SeaTheme / BM Content Builder

0 < 3.17.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/e96376d3-4d17-4611-bdbf-1bb9c68c0ba4?source=cve themeforest.net: https://themeforest.net/item/art-simple-clean-wordpress-theme-for-creatives/20170299

Credits

Tonn