UpHeron
All vulnerabilities

WordPress plugins

CVE-2026-127094

Pagelayer 2.1.7 before 2.2.1 Missing Authorization via Abilities API

Severity
High 7.2
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
2.2.1
Weakness
Missing authorization (CWE-862)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read some data · Change data · Slow it down
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Sources
CVE Program

Description

Pagelayer 2.1.7 before 2.2.1 contains a missing authorization vulnerability in Abilities API abilities registered in main/abilitiesregister.php that only require the edit_posts capability. Contributor-level attackers can overwrite, publish, delete, or duplicate other users' private posts and pages to read them, and modify site-wide theme templates like headers and footers.

From the CVE Program.

Affected software

SoftwareAffected versions
Pagelayer (WordPress plugin)WordPress plugins · wp-plugin:pagelayer
  • From 2.1.7 before 2.2.1

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-127094