CVE-2025-1281: BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Deletion
The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uxcbremovelayoutajax() and uxcbtoolsexportajax() functions in all versions up to, and excluding, 3.17.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BM Content Builderto a version that resolves this vulnerability.Fixed in 3.17.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with at least Subscriber-level access. This means sites that allow user registration or otherwise provide low-privileged accounts have a broader exposure.
Which plugin versions are affected?
All BM Content Builder versions before 3.17.1 are affected. Version 3.17.1 and later are not identified as vulnerable by the provided data.
What is the likely impact of successful exploitation?
A low-privileged authenticated attacker can delete arbitrary files on the server. Deleting a file such as wp-config.php can potentially lead to remote code execution.