CVE-2026-2470: Pagelayer <= 2.0.9 - Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts'
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.0.9. This is due to the pagelayersavecontent AJAX handler allowing users with basic post-edit capability to persist pagelayercontacttemplates metadata on posts they can edit (including pending posts), while the unauthenticated pagelayercontactsubmit endpoint later consumes that metadata by user-controlled post/form identifiers without enforcing a privileged or published-context boundary. This makes it possible for authenticated attackers, with Contributor-level access and above, to configure arbitrary contact-form mail templates that are usable through unauthenticated form submission via the contacts parameter. In typical deployments this template feature is configured via Pagelayer Pro UI; however, the vulnerable backend trust path is still present. This issue may be chained with CVE-2026-2442 to increase exploitability and attacker control over outbound email behavior.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If available in Pagelayer / Pagelayer Pro UI, disable the contact-form template feature (pagelayer_contact_templates) to prevent unauthenticated form submissions from consuming configured templates.
Pagelayer (Page Builder) contact-form templates (pagelayer_contact_templates) = disabled - Compensating control
Block or restrict access to the unauthenticated AJAX endpoint 'pagelayer_contact_submit' (e.g., via WAF, web application firewall rules, webserver access controls or firewall ACLs). Only allow trusted IPs or require authentication for requests that would invoke this endpoint.
- Operational
Audit all posts (including pending posts) for the post meta key 'pagelayer_contact_templates'. Remove or sanitize any unauthorized or suspicious contact-mail templates that may have been persisted by Contributor+ users.
- Operational
Review WordPress accounts with Contributor-level or higher privileges and remove or restrict any untrusted accounts; enforce least-privilege for users who can edit posts to reduce the risk of malicious template persistence.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2470?
CVE-2026-2470 has a medium severity rating of 4.3.
How do I fix CVE-2026-2470?
To fix CVE-2026-2470, update the Pagelayer plugin to version 2.0.10 or later.
What type of vulnerability is CVE-2026-2470?
CVE-2026-2470 is an Incorrect Authorization vulnerability affecting the Pagelayer plugin.
Who is affected by CVE-2026-2470?
Users of the Pagelayer plugin for WordPress up to version 2.0.9 are affected by CVE-2026-2470.
What can attackers do with CVE-2026-2470?
Attackers can exploit CVE-2026-2470 to manipulate mail relay configurations via the contacts feature.