CVE-2025-12366

MediumCVSS 4.3

Published: 13/11/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

The Page Builder: Pagelayer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 2.0.5 via the pagelayer_replace_page function due to missing validation on a user-controlled key. This allows authenticated attackers with Author-level access and above to replace media files belonging to other users, including administrators.

Risk Assessment

The risk includes the ability to replace media files of other users, potentially leading to content integrity compromise and possible injection of malicious code.

Recommendation

Update the Pagelayer plugin to the latest patched version. Also restrict user permissions and regularly audit access to file replacement functionality.

Other vulnerabilities in Pagelayer

CVE-2026-39469Medium
The PageLayer plugin for WordPress up to version 2.0.8 has an exposure of sensitive system information vulnerability that allows retrieving embedded sensitive data.

Original NVD description (English source)

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.5 via the pagelayer_replace_page function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to replace media files belonging to other users, including administrators.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS