PageLayer <= 2.2.0 - Authenticated (Contributor+) Missing Authorization to Arbitrary Page/Post Modification and Deletion
- ID
- WPSEC-2026-0215
- Plugin
- Page Builder: Pagelayer – Drag and Drop website builder (pagelayer)
- Affected
- from 2.1.7 before 2.2.1
- Remediation
- Update to 2.2.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- PageLayer on WPSec AttackSurface
- Fix released
- Published
Description
The Pagelayer plugin for WordPress is vulnerable to unauthorized modification, deletion and duplication of content via its WordPress Abilities API abilities (including update_page, update_post, publish_page, publish_post, delete_page, delete_post, duplicate_page, duplicate_post, the element and transaction abilities, and create_template, update_template and delete_template) in versions 2.1.7 to 2.2.0. This is due to the abilities only requiring the edit_posts capability and the handlers performing no per-object capability checks. This makes it possible for authenticated attackers, with Contributor-level access and above, on sites where the Abilities API is available (WordPress 6.9 and later), to overwrite, publish, trash or permanently delete other users' pages and posts, to create published content, to create, modify or delete site-wide theme templates such as headers and footers, to copy other users' private, draft or password-protected posts into a draft of their own and read them, and to add files to the media library without the upload_files capability.
References
- https://wpsec.com/vuln/WPSEC-2026-0215/
- https://plugins.svn.wordpress.org/pagelayer/tags/2.2.1/
- https://wordpress.org/plugins/pagelayer/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS