GHSA-7v2f-gh7j-2mfrHighCVSS 7.6
Pagelayer 2.1.7 before 2.2.1 contains a missing authorization vulnerability in Abilities API...
🔗 CVE IDs covered (1)
📋 Description
Pagelayer 2.1.7 before 2.2.1 contains a missing authorization vulnerability in Abilities API abilities registered in main/abilitiesregister.php that only require the edit_posts capability. Contributor-level attackers can overwrite, publish, delete, or duplicate other users' private posts and pages to read them, and modify site-wide theme templates like headers and footers.
🔗 References (7)
- https://nvd.nist.gov/vuln/detail/CVE-2026-127094
- https://plugins.svn.wordpress.org/pagelayer/tags/2.1.9/main/abilitiesregister.php
- https://plugins.trac.wordpress.org/changeset/3698421/pagelayer
- https://wpsec.com/vuln/WPSEC-2026-0215
- https://www.vulncheck.com/advisories/pagelayer-2.1.7-before-2.2.1-missing-authorization-via-abilities-api
- https://lazytitan.ro/pagelayer
- https://github.com/advisories/GHSA-7v2f-gh7j-2mfr