A path traversal vulnerability in SeaTheme BM Content Builder, identified as CVE-2025-59002, poses a significant risk of arbitrary file deletion to affected WordPress environments.

This vulnerability is a path traversal flaw (CWE-22) residing in the bm-builder component. It allows an authenticated user with low-level privileges to escape the intended directory and perform unauthorized file deletion operations on the host system.

The ability for an attacker to delete arbitrary files can lead to critical service disruption, potential loss of configuration data, or the destabilization of the WordPress environment. With a CVSS score of 7.7, this flaw is categorized as High severity, necessitating prompt attention to prevent operational downtime or secondary impacts caused by the removal of essential system files.

Immediate Action: Update the SeaTheme BM Content Builder plugin to version 3.16.3.3 or higher to incorporate the necessary security fixes.

Proactive Monitoring: Review web server and WordPress error logs for suspicious file system activity, specifically looking for requests containing directory traversal sequences such as dot-dot-slash patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block path traversal attempts targeting plugin endpoints.

Public Exploit Available: No (Exploit status is unknown; no weaponized exploit or public proof-of-concept exists in the provided data).

Given the High severity rating and the potential for service disruption, administrators should prioritize updating the BM Content Builder plugin immediately. Organizations that cannot update should consider deactivating the plugin until a patch is applied to minimize the attack surface and prevent potential file deletion incidents.