CVE-2025-1926: Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Cross-Site Request Forgery (CSRF) To Post Contents Modification
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.8. This is due to missing or incorrect nonce validation on the pagelayersavepost function. This makes it possible for unauthenticated attackers to modify post contents via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1926?
CVE-2025-1926 is considered a moderate risk vulnerability due to the potential for Cross-Site Request Forgery affecting WordPress sites.
How do I fix CVE-2025-1926?
To fix CVE-2025-1926, update the Pagelayer plugin to version 1.9.9 or later, where the nonce validation issue has been resolved.
Which versions of the Pagelayer plugin are affected by CVE-2025-1926?
CVE-2025-1926 affects all versions of the Pagelayer plugin up to and including version 1.9.8.
What does CVE-2025-1926 allow attackers to do?
CVE-2025-1926 allows attackers to perform unauthorized actions on behalf of users due to missing nonce validation in the plugin.
Is CVE-2025-1926 specific to WordPress?
Yes, CVE-2025-1926 specifically affects the Pagelayer website builder plugin for WordPress.