The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress contains a path traversal vulnerability (CWE-22) in the template_via_url() function. This vulnerability allows authenticated users with at least Contributor privileges to read arbitrary files on the server by manipulating pathname inputs. The issue affects all versions up to and including 1.27.6. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, requiring privileges, no user interaction, and resulting in high confidentiality impact without affecting integrity or availability. No patch or official remediation guidance is currently available from the vendor.

An attacker with Contributor-level or higher access can exploit this vulnerability to read arbitrary files on the server hosting the WordPress plugin. This can lead to disclosure of sensitive information stored on the server. The vulnerability does not allow modification or deletion of data, nor does it affect system availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and monitor for suspicious activity related to file access. Avoid using the vulnerable versions of the plugin if possible.