WordPress BM Content Builder Arbitrary File Deletion Flaw

The BM Content Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ux_cb_remove_layout_ajax() and ux_cb_tools_export_ajax() functions in all versions up to, and excluding, 3.17.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

Casky was already ahead

This CVE exploits attack patterns that Casky's 351matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2025-1281 exploits insufficient file path validation in the BM Content Builder WordPress plugin, allowing authenticated users with minimal Subscriber privileges to delete arbitrary files from the server. The vulnerability exists in the ux_cb_remove_layout_ajax() and ux_cb_tools_export_ajax() functions across all versions before 3.17.1. This is particularly dangerous because deleting critical files like wp-config.php can completely compromise WordPress installations and lead to remote code execution. Any WordPress site running this plugin is at risk, as attackers need only basic account access—a common entry point through credential compromise, plugin vulnerabilities, or social engineering.

Casky's 351 matched security skills leverage Claude's extended reasoning to correlate this vulnerability with MITRE ATT&CK Initial Access (TA0001) and Discovery (TA0007) techniques. Practitioners using Casky would identify CWE-22 (Path Traversal) patterns in AJAX handler logs showing suspicious file path parameters, detect unusual DELETE operations targeting wp-config.php or other critical files, and spot authentication logs showing Subscriber-level accounts performing administrative file operations. The skills would flag the attack chain: initial access via account compromise, reconnaissance of file structure, then weaponization through the unvalidated path parameters to achieve persistence or denial of service. Real-time detection would surface anomalies in request patterns to vulnerable endpoints before files are permanently deleted.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

351 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2025-1281.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0007

Investigate the attack patterns behind CVE-2025-1281

Casky has 351 skills that investigate the attack patterns behind CVE-2025-1281. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn