Post and Page Builder by BoldGrid Path Traversal Vulnerability Allowing Arbitrary File Read

A path traversal vulnerability has been identified in the Post and Page Builder by BoldGrid plugin for WordPress, affecting all versions through 1.27.6. The issue arises in the template_via_url() function, where authenticated attackers with Contributor-level access or higher can exploit the vulnerability to read arbitrary files on the server, potentially accessing sensitive information.

Impact

Exploitation of this vulnerability allows for arbitrary file read on the server, which could lead to exposure of sensitive information.

Reproduction

To reproduce this vulnerability, an authenticated user with Contributor-level access or higher can send a request to the WordPress site with a crafted 'template_choice' parameter. This parameter can be manipulated to traverse directories and access arbitrary files on the server. The 'template_via_url' function will process the request, and if the file read is successful, the contents of the file will be returned.

Remediation

Users are advised to update the Post and Page Builder by BoldGrid plugin to version 1.27.7 or later.