CVE-2025-1279 Overview
CVE-2025-1279 affects the BM Content Builder plugin for WordPress in all versions up to and including 3.16.2.1. The vulnerability stems from a missing capability check on the ux_cb_tools_import_item_ajax AJAX action. Authenticated attackers with Subscriber-level access or higher can update arbitrary WordPress options. Attackers leverage this to change the default registration role to administrator and enable open registration, granting themselves administrative access to the site.
Critical Impact
A Subscriber-level account can escalate to full administrator control of the WordPress site by tampering with site options through an unprotected AJAX handler.
Affected Products
- BM Content Builder plugin for WordPress
- All versions up to and including 3.16.2.1
- WordPress sites with Subscriber registration enabled
Discovery Timeline
- 2025-04-25 - CVE-2025-1279 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-1279
Vulnerability Analysis
The vulnerability is a Missing Authorization flaw [CWE-862] in the BM Content Builder plugin. The ux_cb_tools_import_item_ajax AJAX action processes import requests without verifying that the requesting user has the appropriate capability. WordPress AJAX endpoints registered through wp_ajax_* hooks are accessible to any authenticated user by default. Without an explicit current_user_can() check or nonce validation tied to a privileged action, low-privileged users can invoke administrative functionality.
Because the import handler writes to the WordPress options table, an attacker can overwrite security-sensitive options such as users_can_register and default_role. Setting default_role to administrator and enabling registration creates a path for the attacker to register a new administrative account or escalate an existing one.
Root Cause
The root cause is the absence of a capability check on a privileged AJAX endpoint. The plugin trusts the authenticated session without confirming the user's role. This violates the WordPress security model, which requires server-side authorization for any action that mutates site state.
Attack Vector
Exploitation requires network access and a valid Subscriber-level WordPress account. The attacker sends a crafted POST request to /wp-admin/admin-ajax.php invoking the ux_cb_tools_import_item_ajax action with parameters that overwrite the default_role and users_can_register options. The attacker then registers a new account, which inherits administrator privileges. User interaction is not required, and exploitation can be fully automated.
No public proof-of-concept exploit has been published. Technical details are summarized in the Wordfence Vulnerability Report.
Detection Methods for CVE-2025-1279
Indicators of Compromise
- Unexpected POST requests to /wp-admin/admin-ajax.php with action=ux_cb_tools_import_item_ajax originating from Subscriber accounts
- Changes to the users_can_register or default_role values in the WordPress wp_options table
- New administrator accounts created shortly after suspicious AJAX traffic
- Plugin or theme installations performed by recently registered users
Detection Strategies
- Audit the wp_options table for unauthorized changes to default_role, users_can_register, siteurl, and home
- Inspect web server access logs for POST requests targeting the vulnerable AJAX action
- Correlate Subscriber-level session activity with administrative configuration changes
- Review WordPress user list for unexpected accounts assigned the administrator role
Monitoring Recommendations
- Enable WordPress audit logging for option updates and role changes
- Alert on any modification to default_role outside of a documented change window
- Monitor admin-ajax.php request volume per user account for anomalous spikes
- Track new user registrations and validate against expected business flow
How to Mitigate CVE-2025-1279
Immediate Actions Required
- Disable or remove the BM Content Builder plugin until a patched version is confirmed installed
- Set users_can_register to 0 and confirm default_role is subscriber if open registration is not required
- Audit all administrator accounts and remove any created without authorization
- Force password resets and invalidate active sessions for all users
Patch Information
No patched version has been identified in the available NVD data. Site owners should consult the Wordfence Vulnerability Report and the vendor listing on ThemeForest for the latest fix status. Until a patch is verified, treat the plugin as vulnerable.
Workarounds
- Restrict access to /wp-admin/admin-ajax.php via a Web Application Firewall (WAF) rule that blocks the ux_cb_tools_import_item_ajax action
- Disable new user registration in WordPress general settings
- Limit Subscriber-level account creation and review existing low-privilege accounts
- Apply the principle of least privilege and remove unused plugins from production sites
# Disable user registration and enforce subscriber default role via WP-CLI
wp option update users_can_register 0
wp option update default_role subscriber
# Deactivate the vulnerable plugin until patched
wp plugin deactivate bm-content-builder
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
