Description

The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ux_cb_remove_layout_ajax() and ux_cb_tools_export_ajax() functions in all versions up to, and excluding, 3.17.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-22T08:16:36.250Z",
  "pubdate": "2026-09-22T08:16:36.250Z",
  "executiveSummary": "The BM Content Builder plugin for WordPress is susceptible to an arbitrary file deletion vulnerability resulting from inadequate input validation within its AJAX-based utility functions.\nThe vulnerability resides in the ux_cb_remove_layout_ajax() and ux_cb_tools_export_ajax() functions, which fail to properly sanitize or constrain file paths provided by users.\nThis security flaw enables authenticated attackers with Subscriber-level privileges or higher to delete critical files from the underlying server filesystem.\nThe impact of this vulnerability is severe, as the deletion of core WordPress configuration files, such as wp-config.php, can trigger a site-wide reset or facilitate a complete site takeover.\nRemote code execution can be achieved by deleting specific files that force the application to re-initialize or by manipulating file states to bypass security controls.\nThe vulnerability affects all versions of the plugin up to, and excluding, 3.17.1.\nGiven the low barrier to entry for exploitation and the critical impact on system availability and integrity, this vulnerability poses a significant risk to affected WordPress environments.",
  "technicalDetails": "The root cause of this vulnerability is improper validation of user-supplied input used in file system operations. Specifically, the functions ux_cb_remove_layout_ajax() and ux_cb_tools_export_ajax() do not implement sufficient checks to restrict the scope of file operations to intended plugin directories.\nBy failing to sanitize path components or utilize path traversal prevention mechanisms, these functions allow an authenticated user to pass arbitrary paths through AJAX requests.\nThe attack flow commences with the attacker authenticated as a subscriber or higher, which is the baseline requirement for triggering these specific AJAX handlers. The attacker crafts a request containing a malicious file path targeted at sensitive files outside the plugin's directory, such as the web server's root directory or the WordPress installation directory.\nWhen the server processes the request, the vulnerable function receives the path and proceeds to execute a file deletion operation (e.g., via unlink()) on the specified target. Because the application logic lacks a 'jail' or a whitelist mechanism, it processes the path traversal sequences (e.g., ../../../wp-config.php), effectively deleting critical application files.\nThe exploitation method relies on the server-side process having sufficient file system permissions to delete files within the WordPress directory. Once wp-config.php is deleted, the site enters an unconfigured state. If the attacker can then perform actions that exploit this uninitialized state or manipulate the server environment, they can achieve remote code execution or gain unauthorized administrative access.\nThis vulnerability is present in all versions prior to 3.17.1. The attack is accessible via standard HTTP requests handled by the WordPress AJAX API. Because the functions are exposed to logged-in users, the attack vector is consistently reproducible across environments where the plugin is active and the attacker possesses even the lowest level of user account.\nPost-exploitation impact includes permanent data loss, site defacement, denial-of-service, and potential full system compromise depending on the server configuration and the specific files successfully removed by the attacker."
}