CVE-2025-69055
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-04-01
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| patchstack | bm_content_builder | to 3.16.3.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-69055 is a Path Traversal vulnerability in the SeaTheme BM Content Builder WordPress plugin (versions up to 3.16.3). It allows an attacker with at least Contributor or Developer privileges to download arbitrary files from the affected website, including sensitive files such as login credentials or backups. This vulnerability is classified under OWASP Top 10 A5: Broken Access Control and has a moderate severity with a CVSS score of 6.5. [1]
How can this vulnerability impact me? :
This vulnerability can allow attackers with certain privileges to download arbitrary files from your website, potentially exposing sensitive information like login credentials and backups. This can lead to unauthorized access, data breaches, and compromise of your website's security and integrity. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves monitoring for exploitation attempts targeting the BM Content Builder Plugin, specifically attempts to download arbitrary files by users with Contributor or Developer privileges. Since no official fix is available, applying the Patchstack mitigation rule can help detect and block such attempts. Network or web server logs should be inspected for unusual file download requests or path traversal patterns related to the plugin. Specific commands are not provided in the available resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying the Patchstack mitigation rule provided by Patchstack to block exploitation attempts until an official patch is released. Users should restrict Contributor or Developer privileges carefully and monitor their websites for suspicious activity related to arbitrary file downloads via the BM Content Builder Plugin. Updating the plugin once an official fix is available is also recommended. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows attackers to download arbitrary files, including sensitive files such as those containing login credentials or backups. Such unauthorized access to sensitive data can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and breaches. [1]