Executive Summary

The vulnerability exists in the Page Builder: Pagelayer plugin for WordPress, specifically in all versions up to and including 2.0.9. It is an Incorrect Authorization issue where users with basic post-edit capabilities (such as Contributor-level access) can save arbitrary contact-form mail templates via the pagelayer_save_content AJAX handler. These templates are stored as metadata on posts they can edit, including pending posts. Later, the unauthenticated pagelayer_contact_submit endpoint uses this metadata without enforcing proper privilege or published-post checks, allowing unauthenticated form submissions to use attacker-controlled mail templates.

This means that attackers with limited authenticated access can configure contact form templates that can be exploited by unauthenticated users, potentially enabling misuse of the contact form functionality.

Additionally, this vulnerability can be combined with CVE-2026-2442 to increase the attacker's control over outbound email behavior.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with Contributor-level access or higher to create arbitrary contact-form mail templates that unauthenticated users can then exploit. This could lead to unauthorized use of the website's contact form to send emails using attacker-controlled templates.

The impact includes potential misuse of the website's email functionality, which could be leveraged for spam, phishing, or other malicious email campaigns originating from the vulnerable site.

Since the vulnerability does not affect confidentiality or availability directly (CVSS impact: no confidentiality or availability impact, but low integrity impact), the main risk is related to integrity and misuse of email templates.

Useful 0 Not Useful 0