Description

The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 (exclusive) via the ux_cb_page_customize_save_layout_ajax() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-22T08:16:36.113Z",
  "pubdate": "2026-09-22T08:16:36.113Z",
  "executiveSummary": "The BM Content Builder plugin for WordPress contains a directory traversal vulnerability within its layout saving functionality. This flaw allows authenticated users, starting from the Subscriber role, to read arbitrary files located on the underlying server filesystem. The vulnerability stems from improper validation of user-supplied input paths passed to file-handling operations. By manipulating the input parameters processed by the ux_cb_page_customize_save_layout_ajax() function, an attacker can bypass intended access restrictions and retrieve sensitive configuration files, credentials, or other system-level data. The risk is significant as it provides authenticated users with an elevated capability to perform unauthorized information disclosure, potentially leading to further compromise of the WordPress environment. This vulnerability affects all versions of the BM Content Builder plugin prior to 3.17.1. Exploitation is limited to authenticated attackers, meaning that while remote, it requires an active session with at least Subscriber-level privileges.",
  "technicalDetails": "The vulnerability resides within the ux_cb_page_customize_save_layout_ajax() function of the BM Content Builder plugin, which is responsible for handling AJAX requests related to saving layout customizations. During the execution of this function, the application processes user-controlled input intended to identify or manipulate layout files on the server. The vulnerability manifests because the plugin fails to adequately sanitize or validate the file path parameters before passing them to file system APIs.\nThe root cause is an insecure implementation of path traversal prevention, where the application does not properly enforce directory boundaries or neutralize path traversal sequences (e.g., '../'). Consequently, an attacker can craft a malicious request containing directory traversal sequences to navigate outside of the intended directory structure.\nThe attack flow proceeds as follows: First, an authenticated attacker with at least Subscriber-level access initiates a request to the vulnerable AJAX endpoint. Within the request, the attacker specifies a path parameter containing traversal sequences designed to target a specific sensitive file on the server (e.g., /etc/passwd or wp-config.php). The ux_cb_page_customize_save_layout_ajax() function receives this input and uses it to construct a file path. Due to the lack of sufficient input validation, the application proceeds to access the specified file.\nUpon successful exploitation, the application reads the requested file's contents, which are subsequently returned to the attacker, potentially within the HTTP response or by influencing the application's processing logic to output the contents. This allows the attacker to read arbitrary system files or WordPress configuration files, which often contain database credentials, secret keys, or other sensitive environmental information. The impact of this post-exploitation disclosure is high, as the leaked data may be leveraged to facilitate full site takeover, database access, or remote code execution depending on the contents of the retrieved files. The vulnerability remains effective across all versions up to 3.17.1, as the insecure file handling logic is persistent throughout this range."
}