CVE-2025-2104: Pagelayer WordPress Plugin Auth Bypass Flaw

CVE-2025-2104 Overview

CVE-2025-2104 affects the Pagelayer plugin for WordPress, a drag-and-drop page builder used to construct site content. The vulnerability resides in the pagelayer_save_content() function, which fails to validate whether a user has permission to publish posts. Authenticated attackers with Contributor-level access or higher can bypass the standard WordPress post moderation workflow and directly publish content to the site. All versions up to and including 1.9.8 are affected. The issue is classified as Missing Authorization [CWE-862].

Critical Impact
Contributors and other low-privilege authenticated users can publish arbitrary posts without editorial review, undermining content moderation controls on affected WordPress sites.

Affected Products

Pagelayer plugin for WordPress, versions up to and including 1.9.8
WordPress sites using Pagelayer with Contributor role or higher assigned to untrusted users
Multi-author WordPress installations relying on Pagelayer for content workflows

Discovery Timeline

2025-03-13 - CVE-2025-2104 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2104

Vulnerability Analysis

The vulnerability is a Missing Authorization flaw in the Pagelayer plugin's content-saving logic. The pagelayer_save_content() function accepts requests from authenticated users but does not verify whether the caller holds the publish_posts capability required by WordPress to move a post from draft to published state. As a result, users with Contributor-level access, which normally only permits creating drafts pending review, can force posts into the published state through the plugin's save path. The flaw affects the integrity of the site's editorial workflow rather than confidentiality or availability.

Root Cause

The root cause is an authorization check gap in pagelayer_save_content(). WordPress relies on capability checks such as current_user_can('publish_posts') before transitioning a post's status. Pagelayer's handler processes the incoming post status without enforcing this check, treating any authenticated caller with post-edit privileges as if they could also publish. The plugin conflates edit rights with publish rights.

Attack Vector

Exploitation requires an authenticated account with Contributor privileges or higher on the target WordPress site. The attacker submits a crafted request to the Pagelayer save endpoint, specifying a publish status for the target post. Because the endpoint does not enforce the publish capability, the post is published directly to the live site. The attack is network-based and requires no user interaction from an administrator or editor.

No verified public exploit code is available for CVE-2025-2104. See the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2025-2104

Indicators of Compromise

Posts transitioning directly from draft to publish status when authored by Contributor-level accounts, bypassing the normal pending review step
Unexpected published posts authored by low-privilege users, particularly containing outbound links, spam content, or SEO poisoning payloads
Requests to Pagelayer AJAX endpoints from Contributor accounts followed by immediate post status changes

Detection Strategies

Query the WordPress wp_posts table for entries where post_status = 'publish' and post_author maps to a user whose role is Contributor
Review the WordPress activity log or plugin audit log for post-status transitions initiated by non-editor accounts
Correlate web server access logs for POST requests to Pagelayer save endpoints with subsequent post publication events

Monitoring Recommendations

Enable WordPress audit logging and alert on any publish event performed by a Contributor role
Monitor for anomalous spikes in published content from newly registered or dormant author accounts
Track outbound links and content changes on high-value pages to detect unauthorized publications quickly

How to Mitigate CVE-2025-2104

Immediate Actions Required

Update the Pagelayer plugin to a version later than 1.9.8 that includes the authorization fix referenced in the WordPress Plugin Changeset
Audit all Contributor and Author accounts and remove or downgrade unused or untrusted users
Review recently published posts for unauthorized content and revert any suspicious entries to draft or trash

Patch Information

The Pagelayer maintainers addressed the missing authorization check in the plugin repository. The corresponding fix is documented in the WordPress Plugin Changeset. Site administrators should upgrade to the patched release through the WordPress plugin updater and confirm the installed version is above 1.9.8.

Workarounds

Temporarily restrict Contributor and Author accounts by disabling their ability to use the Pagelayer editor until the plugin is updated
Deactivate the Pagelayer plugin on multi-author sites where immediate patching is not possible
Use a Web Application Firewall rule to block requests to Pagelayer save endpoints that include a publish status parameter from non-editor sessions

bash

# Verify installed Pagelayer version via WP-CLI
wp plugin get pagelayer --field=version

# Update the plugin to the latest patched release
wp plugin update pagelayer

# List posts authored by Contributor-level users that are currently published
wp post list --post_status=publish --author_role=contributor --format=table