Arbitrary File Deletion in BM Content Builder WordPress Plugin

The BM Content Builder plugin for WordPress contains an arbitrary file deletion vulnerability (CVE-2025-1281) resulting from insufficient file path validation within the ux_cb_remove_layout_ajax() and ux_cb_tools_export_ajax() functions. This vulnerability affects all plugin versions up to, and excluding, 3.17.1. Authenticated attackers with Subscriber-level privileges can trigger these functions to delete arbitrary files on the underlying web server. By deleting critical files such as wp-config.php, an attacker can force a WordPress site to enter its installation state, allowing them to gain control over the database, create a new administrative user, and achieve remote code execution. This represents a significant risk for WordPress environments using the BM Content Builder plugin.

Impact

Successful exploitation allows for the deletion of arbitrary files on the web server hosting the WordPress site. If configuration files are removed, attackers can compromise site integrity, elevate privileges to administrator, or gain remote code execution, leading to complete server takeover or data loss.

Recommendation

1. Upgrade the BM Content Builder plugin to version 3.17.1 or later immediately.
2. Audit WordPress installations for unauthorized administrative account creation, which often occurs following the deletion of wp-config.php.
3. Ensure that critical configuration files like wp-config.php have restrictive file system permissions that prevent the web server user from deleting them, where possible.