SeaTheme BM Content Builder Path Traversal Vulnerability Allowing Arbitrary File Download

A path traversal vulnerability has been identified in the SeaTheme BM Content Builder plugin, specifically in versions through 3.16.3. This vulnerability allows for arbitrary file download, enabling attackers to download any file from the affected website, including sensitive files such as login credentials or backup files.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the website, potentially including login credentials or backup files.

Remediation

Users are advised to update to a version of the BM Content Builder plugin that is later than 3.16.3. Patchstack has also issued a mitigation rule to block attacks targeting this vulnerability.