The SeaTheme BM Content Builder plugin for WordPress contains a path traversal vulnerability that allows authenticated users with Subscriber-level access to read sensitive files on the host server.

This vulnerability is a path traversal flaw (CWE-22) residing in the ux_cb_page_customize_save_layout_ajax function. It permits any authenticated attacker with at least Subscriber-level privileges to bypass directory restrictions and access arbitrary files on the underlying filesystem.

Successful exploitation allows unauthorized access to sensitive configuration files, credentials, or other proprietary data stored on the web server. While the CVSS score of 6.5 reflects a Medium severity rating, the potential for data exfiltration poses a significant risk to organizational confidentiality and compliance requirements.

Immediate Action: Update the SeaTheme BM Content Builder plugin to version 3.17.1 or higher immediately to resolve the directory traversal flaw.

Proactive Monitoring: Review web server access logs for suspicious requests containing path traversal sequences, such as dot-dot-slash patterns, directed toward the plugin's AJAX endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts, which can provide temporary protection while the update is being staged.

Public Exploit Available: No

Given that this vulnerability allows for the unauthorized exposure of sensitive server files, administrators should prioritize patching the BM Content Builder plugin. Ensure that user registration settings are audited to prevent unauthorized accounts from gaining the Subscriber-level access necessary to trigger this exploit.