{"id":"CVE-2026-127094","kind":"vulnerability","aliases":["CVE-2026-127094"],"related":[],"title":"Pagelayer WordPress plugin: contributors can edit and delete others' private posts","description":"Pagelayer 2.1.7 before 2.2.1 contains a missing authorization vulnerability in Abilities API abilities registered in main/abilitiesregister.php that only require the edit_posts capability. Contributor-level attackers can overwrite, publish, delete, or duplicate other users' private posts and pages to read them, and modify site-wide theme templates like headers and footers.","summary":"Pagelayer 2.1.7 through 2.2.0 registers Abilities API endpoints that only check the edit_posts capability, so a Contributor-level WordPress user can act on other users' content. An attacker can read private posts and pages, overwrite, publish, delete or duplicate them, and change site-wide headers and footers.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","pagelayer","self-hosted","wordpress"],"not_affected_if":["no-contributor-accounts","pagelayer-not-installed","version-2.2.1-or-later"],"how_to_check":"- Check the installed Pagelayer version in the WordPress plugins list or `wp plugin get pagelayer --field=version`\n- Look for `main/abilitiesregister.php` in the Pagelayer plugin folder\n- Confirm whether Contributor-role accounts exist on the site","fix":"- Pagelayer: move to `2.2.1` or later, per the NVD range (fixed in 2.2.1)","status":"open","published_at":"2026-11-13T10:18:06+00:00","first_seen_at":"2026-11-13T10:47:30+00:00","triaged_at":"2026-11-13T10:52:33+00:00","updated_at":"2026-11-13T10:52:33+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:52:33Z","model":"claude-haiku-5-5","output":{"fix":"- Pagelayer: move to `2.2.1` or later, per the NVD range (fixed in 2.2.1)","reach":"network","title":"Pagelayer WordPress plugin: contributors can edit and delete others' private posts","impact":"medium","summary":"Pagelayer 2.1.7 through 2.2.0 registers Abilities API endpoints that only check the edit_posts capability, so a Contributor-level WordPress user can act on other users' content. An attacker can read private posts and pages, overwrite, publish, delete or duplicate them, and change site-wide headers and footers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","pagelayer","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Contributor reads private posts and changes site-wide headers and footers","analyst_note":"Third-party advisory at www.vulncheck.com is linked but its content was not provided; confirm exact affected range and advisory details there.","how_to_check":"- Check the installed Pagelayer version in the WordPress plugins list or `wp plugin get pagelayer --field=version`\n- Look for `main/abilitiesregister.php` in the Pagelayer plugin folder\n- Confirm whether Contributor-role accounts exist on the site","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["pagelayer-not-installed","version-2.2.1-or-later","no-contributor-accounts"],"who_is_affected":"Sites running the Pagelayer WordPress plugin from 2.1.7 up to but not including 2.2.1 are exposed. Any site that gives accounts the Contributor role, or any account that can reach the Abilities API, can reach the flawed endpoints. Sites without Pagelayer or running 2.2.1 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000799,"input_tokens":4609,"output_tokens":677,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-127094':14A,17A '-2026':13A,16A '2.1.7':25B,75C '2.2.0':27B '2.2.1':77C 'abil':29B,84C,86C 'act':47B 'api':30B,85C 'attack':53B,100C 'author':81C 'capabl':38B,96C 'chang':67B 'check':34B 'contain':78C 'content':51B 'contributor':4A,42B,98C 'contributor-level':41B,97C 'cve':12A,15A 'delet':8A,62B,104C 'duplic':64B,106C 'edit':6A,36B,94C 'endpoint':31B 'footer':73B,126C 'header':71B,124C 'host':22B 'level':43B,99C 'like':123C 'main/abilitiesregister.php':89C 'miss':80C 'modifi':117C 'other':9A 'overwrit':60B,102C 'packag':18B 'page':59B,112C 'pagelay':1A,19B,24B,74C 'plugin':3A 'post':11A,37B,57B,95C,110C 'privat':10A,56B,109C 'publish':61B,103C 'read':55B,114C 'regist':28B,87C 'requir':92C 'self':21B 'self-host':20B 'site':69B,119C 'site-wid':68B,118C 'templat':122C 'theme':121C 'user':45B,50B,108C 'vulner':82C 'wide':70B,120C 'wordpress':2A,23B,44B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Pagelayer WordPress plugin from 2.1.7 up to but not including 2.2.1 are exposed. Any site that gives accounts the Contributor role, or any account that can reach the Abilities API, can reach the flawed endpoints. Sites without Pagelayer or running 2.2.1 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","pagelayer","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-127094':14A,17A '-2026':13A,16A 'contributor':4A 'cve':12A,15A 'delet':8A 'edit':6A 'other':9A 'pagelay':1A 'plugin':3A 'post':11A 'privat':10A 'wordpress':2A","search_b":"'2.1.7':25B '2.2.0':27B 'abil':29B 'act':47B 'api':30B 'attack':53B 'capabl':38B 'chang':67B 'check':34B 'content':51B 'contributor':42B 'contributor-level':41B 'delet':62B 'duplic':64B 'edit':36B 'endpoint':31B 'footer':73B 'header':71B 'host':22B 'level':43B 'overwrit':60B 'packag':18B 'page':59B 'pagelay':19B,24B 'post':37B,57B 'privat':56B 'publish':61B 'read':55B 'regist':28B 'self':21B 'self-host':20B 'site':69B 'site-wid':68B 'user':45B,50B 'wide':70B 'wordpress':23B,44B","search_c":"'2.1.7':75C '2.2.1':77C 'abil':84C,86C 'api':85C 'attack':100C 'author':81C 'capabl':96C 'contain':78C 'contributor':98C 'contributor-level':97C 'delet':104C 'duplic':106C 'edit':94C 'footer':126C 'header':124C 'level':99C 'like':123C 'main/abilitiesregister.php':89C 'miss':80C 'modifi':117C 'overwrit':102C 'page':112C 'pagelay':74C 'post':95C,110C 'privat':109C 'publish':103C 'read':114C 'regist':87C 'requir':92C 'site':119C 'site-wid':118C 'templat':122C 'theme':121C 'user':108C 'vulner':82C 'wide':120C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:18:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127094","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127094","severity":null,"published_at":"2026-11-13T10:18:06+00:00","modified_at":"2026-11-13T10:18:06+00:00","first_seen_at":"2026-11-13T10:47:30+00:00","fetched_at":"2026-11-13T10:47:30+00:00","note":null}],"documents":[{"id":145322,"url":"https://www.vulncheck.com/advisories/pagelayer-2.1.7-before-2.2.1-missing-authorization-via-abilities-api","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}