CVE-2025-12366 Overview
CVE-2025-12366 is an Insecure Direct Object Reference (IDOR) vulnerability in the Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress. The flaw affects all versions up to and including 2.0.5. It resides in the pagelayer_replace_page function, which fails to validate a user-controlled key before performing media replacement operations. Authenticated attackers with Author-level access or higher can replace media files owned by other users, including administrators. The vulnerability is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.
Critical Impact
Author-level users can overwrite administrator-owned media files, enabling content tampering and potential defacement across the WordPress site.
Affected Products
- Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress
- All versions up to and including 2.0.5
- Vulnerable component: pagelayer_replace_page function in replace-media.php
Discovery Timeline
- 2025-11-13 - CVE-2025-12366 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-12366
Vulnerability Analysis
The Pagelayer plugin exposes a media replacement workflow through the pagelayer_replace_page function. This function accepts a key from the request that identifies the target media object. The plugin does not verify that the authenticated user owns the referenced media asset before performing the replacement.
An attacker authenticated as an Author can submit a crafted request that references a media file owned by another user. The plugin replaces the referenced file without an ownership check. This impacts integrity by allowing modification of assets belonging to administrators or other privileged users. Confidentiality and availability are not directly affected by this flaw.
Technical details of the vulnerable code path are available in the Pagelayer replace-media.php source and the Wordfence Vulnerability Report.
Root Cause
The root cause is missing authorization validation on a user-controlled identifier. The pagelayer_replace_page function trusts the client-supplied key that specifies which media object to replace. It does not enforce a permission check binding the requesting user to the target object. This is a classic Insecure Direct Object Reference pattern classified as [CWE-639].
Attack Vector
Exploitation requires network access to the WordPress site and valid credentials for an account with Author-level access or higher. An attacker submits a request to the vulnerable endpoint with a modified object key that points to a media file owned by another user. The plugin then processes the file replacement using attacker-supplied content. No user interaction from the victim is required.
No public proof-of-concept exploit is currently listed for this CVE. The vulnerability mechanism is described in the Pagelayer changeset log that introduced the fix.
Detection Methods for CVE-2025-12366
Indicators of Compromise
- Unexpected modifications to media files in wp-content/uploads/ where file authorship or metadata no longer matches the original uploader.
- HTTP POST requests to Pagelayer AJAX endpoints invoking pagelayer_replace_page from Author-level accounts targeting media IDs owned by other users.
- New or altered media files whose modification timestamps differ substantially from their original upload times.
Detection Strategies
- Audit WordPress access logs for requests to Pagelayer replace-media endpoints correlated with non-administrator user sessions.
- Compare current media file hashes against a known-good baseline to identify unauthorized replacements.
- Review the WordPress wp_posts table for attachment entries whose post_author no longer matches the actual uploader based on external inventory.
Monitoring Recommendations
- Enable verbose logging for Pagelayer plugin actions and forward events to a centralized log platform for correlation.
- Alert on media replacement operations initiated by non-administrator accounts.
- Monitor for privilege changes and creation of new Author-level accounts that could be used to stage exploitation.
How to Mitigate CVE-2025-12366
Immediate Actions Required
- Upgrade the Pagelayer plugin to a version later than 2.0.5 that includes the fix referenced in the vendor changeset.
- Audit all Author-level and above accounts and remove any that are unnecessary or unrecognized.
- Restore any media files identified as tampered from verified backups.
Patch Information
The vendor addressed the vulnerability in the changeset published on plugins.trac.wordpress.org. The fix adds validation to ensure the requesting user is authorized to modify the referenced media object. Site administrators should update to the latest Pagelayer release available in the WordPress plugin repository.
Workarounds
- Restrict Author-level access to trusted users only until the patch can be applied.
- Deploy a Web Application Firewall (WAF) rule to block or inspect requests to the Pagelayer media replacement endpoint.
- Temporarily deactivate the Pagelayer plugin if the patched version cannot be deployed immediately and the plugin is not required for site operation.
# Configuration example: update the Pagelayer plugin using WP-CLI
wp plugin update pagelayer
wp plugin get pagelayer --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
