CVE-2025-0859

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-0859
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-0859.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-0859
Published
2025-02-06T09:21:17Z
Modified
2026-08-12T03:51:29Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Post and Page Builder by BoldGrid <= 1.27.6 - Path Traversal to Authenticated (Contributor+) Arbitrary File Read via template_via_url Function
Details

The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.27.6 via the template_via_url() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Database specific 
{
    "cna_assigner":  "Wordfence",
    "cwe_ids":  [
        "CWE-22"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/0xxx/CVE-2025-0859.json"
}
References

Affected packages

Git / github.com/boldgrid/post-and-page-builder

Affected ranges

Type
GIT
Repo
https://github.com/boldgrid/post-and-page-builder
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f48b71fb1cf128e58d2c09967b323f872487e3a4
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:boldgrid:post_and_page_builder:*:*:*:*:*:wordpress:*:*",
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "1.27.6"
        },
        {
            "fixed":  "1.27.7"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

1.*
1.0.8
1.0.9
1.1
1.1.1
1.1.1.1
1.1.1.2
1.1.2
1.1.3
1.10.0
1.10.0-rc.1
1.10.1
1.10.2
1.10.3
1.10.4
1.10.5
1.10.6
1.11.0
1.11.0-rc.1
1.11.1
1.11.2
1.12.0
1.12.1
1.12.2
1.13.0
1.13.1
1.13.2
1.13.3
1.13.3-rc.1
1.13.4
1.13.5
1.13.5-rc.1
1.13.6
1.14.0
1.14.1
1.14.2
1.15.0
1.15.1
1.15.2
1.16.0
1.17.0
1.18.0
1.2.13
1.2.6
1.2.7
1.2.8
1.2.9
1.21.2
1.21.3
1.22.1
1.22.1-rc1
1.22.2
1.23.0
1.23.1
1.23.2
1.24.0
1.24.2
1.25.0
1.25.1
1.26.0
1.26.1
1.26.2
1.26.3
1.26.4
1.26.5
1.26.6
1.26.7
1.27.0
1.27.1
1.27.2
1.27.3
1.27.4
1.27.5
1.27.6
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.6
1.4.7
1.4.8
1.5.1
1.5.2
1.6
1.6.1
1.7.0
1.7.0-alpha.1
1.7.0-alpha.2
1.7.0-rc.1
1.7.0-rc.2
1.7.0-rc.3
1.7.0-rc.4
1.7.0-rc.5
1.7.1
1.8.0
1.8.0-alpha.1
1.8.0-alpha.3
1.8.0-rc.1
1.8.0-rc.2
1.8.0-rc.3
1.8.0-rc.4
1.8.0-rc.5
1.9.0
1.9.0-rc.1
1.9.0-rc.2
1.9.0-rc.3
Other
uability-testing

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-0859.json"