Arbitrary File Deletion in BM Content Builder WordPress Plugin

Executive Summary

The BM Content Builder plugin for WordPress has a vulnerability that allows authenticated users with Subscriber-level access or higher to delete arbitrary files on the server. This is due to insufficient validation in the ux_cb_remove_layout_ajax() and ux_cb_tools_export_ajax() functions in versions up to 3.17.0.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized file deletions or modifications in WordPress directories. Review server logs for suspicious activity from Subscriber-level accounts. Inspect plugins for BM Content Builder versions below 3.17.1.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to delete critical files like wp-config.php, leading to remote code execution. This could compromise the entire WordPress site, allowing unauthorized access or control.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows authenticated attackers to delete arbitrary files on the server, which could include sensitive data files or configuration files. Such unauthorized file deletion may lead to data breaches or system compromise, potentially violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Update the BM Content Builder plugin to version 3.17.1 or later. Remove or disable the plugin if not needed. Restrict Subscriber-level access to only trusted users.

Useful 0 Not Useful 0