Unauthorized Post Publication in Pagelayer Website Builder Plugin
CVE-2025-2104
4.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 13 March 2025
What is CVE-2025-2104?
The Pagelayer Drag and Drop website builder plugin for WordPress has a vulnerability that allows authenticated attackers, including those with Contributor-level access and above, to bypass the post moderation process. This flaw arises from inadequate validation within the pagelayer_save_content() function, present in all versions up until 1.9.8. As a result, such attackers can publish unauthorized posts directly, potentially leading to the dissemination of malicious content or misinformation on the site.
Affected Version(s)
Page Builder: Pagelayer – Drag and Drop website builder * <= 1.9.8