The vulnerability arises from a path traversal flaw in the visual drag‑and‑drop editor of the BoldGrid Post and Page Builder plugin. By manipulating the file path parameter in a request to the plugin, an attacker can read any file on the server’s file system, potentially exposing configuration files, passwords, or other sensitive data, thereby compromising confidentiality.

BoldGrid:Post and Page Builder by BoldGrid, a WordPress plugin. All releases from the initial version through v1.27.8 are affected. Sites running any version of the plugin that is ≤ 1.27.8 are at risk.

The CVSS score of 4.2 indicates low‑to‑medium severity, and the EPSS score is below 1%, suggesting that real‑world exploitation is unlikely at this time. This vulnerability is not listed in the CISA KEV catalog. The flaw is triggered by an HTTP request to the plugin’s endpoint, so the likely attack vector is remote exploitation by any visitor who can send crafted requests to the WordPress site.