CVE-2025-1280

6.5 MEDIUM

Published 2026-09-22 · Updated 2026-09-22

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 (exclusive) via the ux_cb_page_customize_save_layout_ajax() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-22

References

https://themeforest.net/item/art-simple-clean-wordpress-theme-for-creatives/20170299
https://www.wordfence.com/threat-intel/vulnerabilities/id/e96376d3-4d17-4611-bdbf-1bb9c68c0ba4?source=cve

Data: NVD (public domain). Analysis: local $0 model. Defensive use only.