This flaw is a path traversal vulnerability that lets an attacker download arbitrary files from the web server where WordPress is installed. By manipulating the file path parameter handled by the BM Content Builder plugin, an attacker can read files such as configuration files, user uploads, or private data, compromising confidentiality and potentially exposing credentials or private content.

All WordPress sites that use the SeaTheme BM Content Builder plugin with a version older than 3.16.3.3 are affected. The vulnerability applies to every installation of the plugin before the specified version and can affect any WordPress site that has the plugin activated.

The CVSS score of 6.5 rates the vulnerability as moderate, while the EPSS score of less than 1% indicates a low probability of exploitation at the time of assessment. The flaw is not currently listed in the CISA KEV catalog, but it can be exploited remotely through crafted HTTP requests without authentication, provided the plugin’s parameter handling is exposed. An attacker could retrieve files from any directory the web server user can read, potentially leading to broader system compromise if sensitive files are accessed.