CVE-2026-127094: Pagelayer 2.1.7 before 2.2.1 Missing Authorization via Abilities API
Pagelayer 2.1.7 before 2.2.1 contains a missing authorization vulnerability in Abilities API abilities registered in main/abilitiesregister.php that only require the editposts capability. Contributor-level attackers can overwrite, publish, delete, or duplicate other users' private posts and pages to read them, and modify site-wide theme templates like headers and footers.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
A user with the Contributor role can exploit it because the affected Abilities API endpoints require only the edit_posts capability. No higher-privileged role is required.
What actions could an attacker take?
An attacker can overwrite, publish, delete, or duplicate other users' private posts and pages, allowing those private items to be read. They can also modify site-wide theme templates, including headers and footers.
Which versions are affected?
Pagelayer versions from 2.1.7 before 2.2.1 are affected.