Description
Pagelayer 2.1.7 before 2.2.1 contains a missing authorization vulnerability in Abilities API abilities registered in main/abilitiesregister.php that only require the edit_posts capability. Contributor-level attackers can overwrite, publish, delete, or duplicate other users' private posts and pages to read them, and modify site-wide theme templates like headers and footers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Pagelayer Team | Pagelayer | 2.1.7 – < 2.2.1 | 2.2.1 |
References
- https://wpsec.com/vuln/WPSEC-2026-0215 third-party-advisory
- https://plugins.trac.wordpress.org/changeset/3698421/pagelayer patch
- https://plugins.svn.wordpress.org/pagelayer/tags/2.1.9/main/abilitiesregister.php technical-description
- https://lazytitan.ro/pagelayer technical-description
- VulnCheck Advisory: Pagelayer 2.1.7 before 2.2.1 Missing Authorization via Abilities API third-party-advisory