CVE-2025-1280— BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Read
Quick assessment
Affected
SeaTheme BM Content Builder
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 的 BM Content Builder 插件在所有低于 3.17.1 的版本中（不包含 3.17.1）存在目录遍历（Directory Traversal）漏洞。该漏洞可通过 函数触发，使得具备 Subscriber（订阅者）权限或更高权限的已认证攻击者能够读取服务器上任意文件的内容，而这些文件可能包含敏感信息。
Possible ATT&CK Techniques 1 AI
T1083 · File and Directory DiscoveryAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| SeaTheme | BM Content Builder | < 3.17.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-1280
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Read
Source: CVE Program / CVE List V5
Vulnerability Description
The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 (exclusive) via the ux_cb_page_customize_save_layout_ajax() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SeaTheme | BM Content Builder | 0 ~ 3.17.1 | - |
|
II. Public POCs for CVE-2025-1280
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-1280
请登录查看更多情报信息。
Other References for CVE-2025-1280 (2)
IV. Related Vulnerabilities
Same product: BM Content Builder
-
CVE-2025-1281
BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Ar -
CVE-2025-69055
WordPress BM Content Builder plugin < 3.16.3.3 - Arbitrary F -
CVE-2025-59002
WordPress BM Content Builder Plugin < 3.16.3.3 - Arbitrary F -
CVE-2025-1777
BM Content Builder <= 3.16.2.1 - Missing Authorization to Au -
CVE-2025-1279
BM Content Builder <= 3.16.2.1 - Missing Authorization to Au
Same vendor: SeaTheme
-
CVE-2025-1281
BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Ar -
CVE-2025-69055
WordPress BM Content Builder plugin < 3.16.3.3 - Arbitrary F -
CVE-2025-59002
WordPress BM Content Builder Plugin < 3.16.3.3 - Arbitrary F -
CVE-2025-1777
BM Content Builder <= 3.16.2.1 - Missing Authorization to Au -
CVE-2025-1778
Art Theme <= 3.12.2.3 - Missing Authorization to Authenticat
Same weakness: CWE-22
-
CVE-2026-115569
Fallow: Jest and Vitest `projects` entries let an analyzed r -
CVE-2026-46652
Path traversal via HTTP `Content-Disposition` header in Exte -
CVE-2026-114623
baserCMS: Path traversal in the BcThemeFile admin screen all -
CVE-2026-114622
baserCMS: Encoded path traversal bypass in the theme file AP -
CVE-2026-57208
Entire CLI: Path traversal in checkpoint session metadata al
V. Comments for CVE-2025-1280
No comments yet