CVE-2025-59002: Arbitrary File Access in BM Content Builder

The Arbitrary File Access vulnerability allows an attacker to bypass intended access controls and read arbitrary files on the server hosting the BM Content Builder plugin. This could expose sensitive data such as configuration files, database credentials, or even source code. Successful exploitation could lead to a complete compromise of the WordPress site and potentially the underlying server. While the description doesn't specify a direct path to remote code execution, the ability to read sensitive files could be a stepping stone for further attacks, such as gaining access to database credentials and then exploiting other vulnerabilities.

1. Reserved2025-09-06
2. Published2025-09-26
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-59002 is to immediately upgrade the BM Content Builder plugin to version 3.16.3.3 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to block requests containing path traversal sequences (e.g., ../). Additionally, restrict file permissions on the WordPress installation to minimize the potential damage from a successful exploit. Monitor WordPress access logs for suspicious requests containing path traversal attempts.