CVE-2026-127094

Description

Pagelayer 2.1.7 before 2.2.1 contains a missing authorization vulnerability in Abilities API abilities registered in main/abilitiesregister.php that only require the edit_posts capability. Contributor-level attackers can overwrite, publish, delete, or duplicate other users' private posts and pages to read them, and modify site-wide theme templates like headers and footers.

References

• https://plugins.svn.wordpress.org/pagelayer/tags/2.1.9/main/abilitiesregister.php
• https://plugins.trac.wordpress.org/changeset/3698421/pagelayer
• https://wpsec.com/vuln/WPSEC-2026-0215
• https://www.vulncheck.com/advisories/pagelayer-2.1.7-before-2.2.1-missing-authorization-via-abilities-api