CVE-2025-12366: Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.5 - Authenticated (Author+) Insecure Direct Object Reference
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.5 via the pagelayerreplacepage function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to replace media files belonging to other users, including administrators.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12366?
CVE-2025-12366 has a critical severity rating due to the potential for unauthorized access to sensitive resources.
How do I fix CVE-2025-12366?
To fix CVE-2025-12366, upgrade to Pagelayer version 2.0.6 or later to ensure proper validation is implemented.
Which versions of Pagelayer are affected by CVE-2025-12366?
CVE-2025-12366 affects all versions of Pagelayer up to and including 2.0.5.
What type of vulnerability is CVE-2025-12366?
CVE-2025-12366 is classified as an Insecure Direct Object Reference vulnerability.
Can CVE-2025-12366 lead to data exposure?
Yes, CVE-2025-12366 can lead to unauthorized access and potential data exposure due to insufficient validation.