Cross-Site Request Forgery in Pagelayer - WordPress Website Builder Plugin

CVE-2025-1926

What is CVE-2025-1926?

The Pagelayer plugin, a popular drag-and-drop website builder for WordPress, is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability that affects all versions up to and including 1.9.8. The vulnerability arises from insufficient nonce validation in the pagelayer_save_post function, allowing unauthorized attackers to manipulate post content through deceitful requests. If an administrator is tricked into clicking a malicious link, the attacker can exploit this vulnerability to make unauthorized changes to the site's posts, potentially leading to a range of security issues for the affected site.

References