CVE-2025-59002: BM Content Builder Path Traversal Flaw

CVE-2025-59002 Overview

CVE-2025-59002 is a path traversal vulnerability [CWE-22] in the SeaTheme BM Content Builder plugin for WordPress. The flaw affects all versions of bm-builder up to and including 3.16.3.3. Authenticated attackers with low privileges can traverse outside the intended directory and delete arbitrary files on the server. Successful exploitation can corrupt WordPress installations, remove configuration files such as wp-config.php, and trigger site-wide denial of service. The vulnerability is exploitable over the network without user interaction.

Critical Impact
Authenticated attackers can delete arbitrary files on the WordPress server, leading to site compromise and denial of service.

Affected Products

SeaTheme BM Content Builder (bm-builder) WordPress plugin
Versions from initial release through 3.16.3.3
WordPress sites with the plugin installed and active

Discovery Timeline

2025-09-26 - CVE-2025-59002 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-59002

Vulnerability Analysis

The vulnerability resides in a file handling routine within the BM Content Builder plugin that accepts a user-supplied pathname without proper validation. The plugin fails to canonicalize or restrict the input to an allowed base directory. As a result, attackers can supply traversal sequences such as ../ to escape the intended directory and reference files anywhere the web server process has write or delete permissions.

The Patchstack advisory categorizes this issue as an arbitrary file deletion vulnerability. Deleting critical files such as wp-config.php can force WordPress into its installation state, allowing an attacker to re-link the site to a database under their control. This pathway can escalate to full site takeover even though the vulnerability itself only impacts availability.

The attack requires authenticated access at a low privilege tier, such as a subscriber or contributor account, which lowers the bar in environments that permit open registration.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory. The plugin passes user-controlled input directly to a file deletion function without normalizing the path or verifying that the resolved location remains within the plugin's working directory.

Attack Vector

An authenticated attacker sends a crafted HTTP request to the plugin endpoint responsible for file management. The request includes a relative path containing directory traversal sequences pointing to a target file outside the plugin scope. The server resolves the path and executes the deletion against the attacker-chosen file. No social engineering or victim interaction is required.

Refer to the Patchstack Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-59002

Indicators of Compromise

HTTP POST requests to bm-builder plugin endpoints containing ../ or URL-encoded variants such as %2e%2e%2f in path parameters
Unexpected deletion of WordPress core files including wp-config.php, .htaccess, or files under wp-includes/
WordPress entering setup mode unexpectedly, indicating loss of configuration files
Web server error logs showing missing file errors for previously valid resources

Detection Strategies

Inspect WordPress access logs for requests targeting bm-builder AJAX or admin-ajax endpoints with path-like parameters
Apply file integrity monitoring across the WordPress installation to alert on deletion of core or plugin files
Correlate authenticated low-privilege user sessions with file system change events occurring in close time proximity

Monitoring Recommendations

Enable WordPress audit logging plugins to capture user-initiated plugin actions and file operations
Forward web server and WordPress logs to a centralized analytics platform for path traversal pattern matching
Alert on HTTP 200 responses to plugin endpoints that immediately precede missing file errors

How to Mitigate CVE-2025-59002

Immediate Actions Required

Identify all WordPress sites running the BM Content Builder (bm-builder) plugin and inventory their versions
Deactivate and remove the plugin on any installation running version 3.16.3.3 or earlier until a fixed release is verified
Restrict user registration and audit existing low-privilege accounts for unexpected activity
Back up WordPress core files, configuration, and the database before applying changes

Patch Information

The NVD record lists affected versions through < 3.16.3.3. Consult the Patchstack Vulnerability Report for the latest fixed version information from SeaTheme and apply the vendor-supplied update as soon as it is available.

Workarounds

Remove or disable the plugin until a verified patched version is installed
Deploy a web application firewall rule blocking path traversal sequences such as ../ and %2e%2e%2f in requests to bm-builder endpoints
Enforce least privilege by restricting plugin-related capabilities to trusted administrators only
Configure file system permissions so the web server user cannot delete WordPress core configuration files

bash

# Example ModSecurity rule to block path traversal targeting the plugin
SecRule REQUEST_URI "@contains bm-builder" \
  "chain,id:1059002,phase:2,deny,status:403,log,msg:'CVE-2025-59002 path traversal attempt'"
  SecRule ARGS "@rx (\.\./|%2e%2e%2f|%2e%2e/)" "t:lowercase,t:urlDecodeUni"