CVE-2025-1280 is a directory traversal vulnerability in the BM Content Builder WordPress plugin affecting all versions from 0 up to but not including 3.17.1. The vulnerability exists in the ux_cb_page_customize_save_layout_ajax() function, allowing authenticated users with low privileges (Subscriber and above) to read arbitrary files on the server. This improper limitation of pathname access (CWE-22) can lead to disclosure of sensitive server files. No known exploits are reported in the wild. The CVSS 3.1 base score is 6.5 (medium), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high confidentiality impact.

An attacker with at least Subscriber-level access can read arbitrary files on the server, potentially exposing sensitive information such as configuration files, credentials, or other protected data. There is no impact on integrity or availability reported. This could lead to further attacks if sensitive data is disclosed.

No official patch or fix is explicitly stated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted users only and monitor for suspicious activity related to the vulnerable function. Consider disabling or removing the BM Content Builder plugin if possible.