CVE-2025-0859 json
Post and Page Builder by BoldGrid <= 1.27.6 - Path Traversal to Authenticated (Contributor+) Arbitrary File Read via template_via_url Function
published 2025-02-06 21 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-1899
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.27.6 via the template_via_url() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Patch / fix
- boldgrid post_and_page_builder 1.27.7
- boldgrid post_and_page_builder_by_boldgrid_-_visual_drag_and_drop_editor 1.27.7
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction
0.67% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected products
- boldgrid Post and Page Builder by BoldGrid – Visual Drag and Drop Editor
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
- Technology feeds
References
-
github.com
/BoldGrid/post-and-page-builder/pull/638/commits/10e4d1d96fd2735379049259d15896fa6dd35471
patch
-
plugins.trac.wordpress.org
/browser/post-and-page-builder/trunk/includes/class-boldgrid-editor-preview.php#L178
patch
-
plugins.trac.wordpress.org
/changeset?old=3234175&old_path=post-and-page-builder%2Ftags%2F1.27.7%2Fincludes%2Fclass-boldgrid-editor-previ
patch
-
wordfence.com
/threat-intel/vulnerabilities/id/111a1e7f-bc87-4130-a0b2-422d0f98afb6?source=cve
third-party-advisory
-
wordpress.org
/plugins/post-and-page-builder/#developers
product
Sources
- CVE List CVE-2025-0859
- NVD CVE-2025-0859
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.