CVE-2026-127094

Name of the Vulnerable Software and Affected Versions Pagelayer versions 2.1.7 through 2.2.0

Description A missing authorization issue exists in the Abilities API within the main/abilitiesregister.php file. This flaw allows attackers with contributor-level permissions to bypass intended restrictions because the API only requires the edit posts capability. Consequently, an attacker can create, read, update, or delete private posts and pages belonging to other users, as well as modify site-wide theme templates, including headers and footers.

Recommendations Update Pagelayer to version 2.2.1.