The BM Content Builder plugin for WordPress lacks proper file path validation in the ux_cb_remove_layout_ajax() and ux_cb_tools_export_ajax() functions. This oversight allows any authenticated user with Subscriber or higher privileges to delete arbitrary files on the server. Because WordPress uses files such as wp-config.php to store critical configuration, the removal of such files can easily lead to remote code execution, allowing an attacker to take control of the site.

SeaTheme’s BM Content Builder plugin for WordPress, in all versions up to but not including 3.17.1, is affected. The vulnerability is present in versions 3.0 through 3.17.0; any deployment of the plugin on a WordPress site should be considered vulnerable unless it has been upgraded to 3.17.1 or later.

The CVSS score of 8.8 classifies this issue as high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires authentication, specifically Subscriber-level access or higher, and the attacker must be able to trigger the vulnerable AJAX endpoints. Once those prerequisites are met, the attacker can delete arbitrary files, including critical wp-config.php, which provides a clear route to remote code execution. Because the flaw exists in commonly used WordPress themes, the potential impact is significant for sites that have the plugin installed and contain Subscriber+ users.