CVE-2025-0859 is a path traversal vulnerability classified under CWE-22 found in the Post and Page Builder by BoldGrid – Visual Drag and Drop Editor WordPress plugin. This vulnerability exists in all versions up to and including 1.27.6 and is exploitable via the template_via_url() function. The flaw allows authenticated attackers with Contributor-level privileges or higher to manipulate file path inputs improperly, bypassing directory restrictions and reading arbitrary files on the hosting server. This can expose sensitive files such as configuration files, credentials, or other private data stored on the server. The vulnerability does not require user interaction beyond authentication and does not impact integrity or availability, but it compromises confidentiality significantly. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, and the need for privileges but no user interaction. No known public exploits have been reported yet, but the vulnerability poses a risk to WordPress sites using this plugin, which is popular among website builders. The lack of a patch link indicates that a fix may not yet be publicly available, emphasizing the need for immediate mitigation steps.

The primary impact of CVE-2025-0859 is unauthorized disclosure of sensitive information due to arbitrary file read capabilities. Attackers with Contributor-level access can leverage this vulnerability to access configuration files, database credentials, or other sensitive data stored on the server, potentially leading to further compromise such as privilege escalation or data breaches. Since WordPress powers a significant portion of websites globally, and BoldGrid is a widely used plugin for site building, many organizations could be affected. The vulnerability does not affect system integrity or availability directly but can facilitate more severe attacks if sensitive data is exposed. Organizations relying on this plugin risk data leakage, reputational damage, and compliance violations if exploited. The medium severity score reflects the balance between the required privileges and the high confidentiality impact.

Organizations should immediately review user roles and restrict Contributor-level or higher access to trusted users only. Implement strict access controls and monitor logs for unusual file access patterns related to the plugin. Disable or uninstall the BoldGrid Post and Page Builder plugin if not essential until a patch is released. Use web application firewalls (WAFs) with custom rules to detect and block path traversal attempts targeting the template_via_url() function. Regularly back up website data and server configurations to enable recovery in case of compromise. Stay informed about updates from BoldGrid and apply patches promptly once available. Additionally, conduct security audits on WordPress plugins to identify and remediate similar vulnerabilities proactively.