CVE-2026-127094

EUVD-2026-125089
Pagelayer 2.1.7 before 2.2.1 contains a missing authorization vulnerability in Abilities API abilities registered in main/abilitiesregister.php that only require the edit_posts capability. Contributor-level attackers can overwrite, publish, delete, or duplicate other users' private posts and pages to read them, and modify site-wide theme templates like headers and footers.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.6 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 34.47%
Common Weakness Enumeration
References
https://lazytitan.ro/pagelayer
https://plugins.svn.wordpress.org/pagelayer/tags/2.1.9/main/abilitiesregister.php
https://plugins.trac.wordpress.org/changeset/3698421/pagelayer
https://wpsec.com/vuln/WPSEC-2026-0215
https://www.vulncheck.com/advisories/pagelayer-2.1.7-before-2.2.1-missing-authorization-via-abilities-api