AJAX Action Endpoint Vulnerability in PageLayer Plugin for WordPress

CVE-2020-35947

Summary

A significant vulnerability was found in the PageLayer plugin for WordPress, preceding version 1.1.2. The flaw stems from inadequate permission checks on nearly all AJAX action endpoints, enabling any authenticated user to perform actions that should be restricted. This issue arises from the use of nonces as a form of authorization; however, a nonce was exposed on a publicly accessible page. One of the most concerning consequences of this vulnerability is the pagelayer_save_content function, which permits unauthorized modifications to web pages. Consequently, this may lead to Cross-Site Scripting (XSS) attacks, increasing the risk for websites utilizing this plugin.

References