CVE-2025-1280CWE-22path-traversal

CVE-2025-1280

Medium · published September 22, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
44.2
In the wild
Unconfirmed
What it is

The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 (exclusive) via the ux_cb_page_customize_save_layout_ajax() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00533 · 44.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-09-22T12:16Z
References (2)
https://themeforest.net/item/art-simple-clean-wordpress-theme-for-creatives/20170299 · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/e96376d3-4d17-4611-bdbf-1bb9c68c0ba4?source=cve · [email protected]
EPSS history
Timeline
  • 23 SEP 03:37Z
    EPSS moved — → 1%
    epss
  • 22 SEP 07:41Z
    BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Read
    cvelistv5