CVE-2025-1281— BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Deletion
Quick assessment
Affected
SeaTheme BM Content Builder
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 的 BM Content Builder 插件存在任意文件删除漏洞，原因是 和 函数中对文件路径的验证不足。该漏洞影响所有低于 3.17.1 的版本（不含 3.17.1）。这使得经过身份验证的攻击者（具备订阅者级别及以上权限）可以删除服务器上的任意文件，当被删除的文件是特定关键文件（例如 wp-config.php）时，可能轻易导致远程代码执行。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| SeaTheme | BM Content Builder | < 3.17.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-1281
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Deletion
Source: CVE Program / CVE List V5
Vulnerability Description
The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ux_cb_remove_layout_ajax() and ux_cb_tools_export_ajax() functions in all versions up to, and excluding, 3.17.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SeaTheme | BM Content Builder | 0 ~ 3.17.1 | - |
|
II. Public POCs for CVE-2025-1281
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-1281
请登录查看更多情报信息。
Other References for CVE-2025-1281 (2)
IV. Related Vulnerabilities
Same product: BM Content Builder
-
CVE-2025-1280
BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Ar -
CVE-2025-69055
WordPress BM Content Builder plugin < 3.16.3.3 - Arbitrary F -
CVE-2025-59002
WordPress BM Content Builder Plugin < 3.16.3.3 - Arbitrary F -
CVE-2025-1777
BM Content Builder <= 3.16.2.1 - Missing Authorization to Au -
CVE-2025-1279
BM Content Builder <= 3.16.2.1 - Missing Authorization to Au
Same vendor: SeaTheme
-
CVE-2025-1280
BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Ar -
CVE-2025-69055
WordPress BM Content Builder plugin < 3.16.3.3 - Arbitrary F -
CVE-2025-59002
WordPress BM Content Builder Plugin < 3.16.3.3 - Arbitrary F -
CVE-2025-1777
BM Content Builder <= 3.16.2.1 - Missing Authorization to Au -
CVE-2025-1778
Art Theme <= 3.12.2.3 - Missing Authorization to Authenticat
Same weakness: CWE-22
-
CVE-2026-115800
UbiquitousLearning mllm Convertor __init__.py load_model pat -
CVE-2026-115569
Fallow: Jest and Vitest `projects` entries let an analyzed r -
CVE-2026-46652
Path traversal via HTTP `Content-Disposition` header in Exte -
CVE-2026-114623
baserCMS: Path traversal in the BcThemeFile admin screen all -
CVE-2026-114622
baserCMS: Encoded path traversal bypass in the theme file AP
V. Comments for CVE-2025-1281
No comments yet