CVE-2026-2470: Pagelayer WordPress Plugin Authorization Bypass in Contact Form Templates

Technical summary

Pagelayer versions up to 2.0.9 suffer from insufficient authorization checks across two separate code paths. The pagelayer_save_content AJAX handler (requiring only post-edit capability) allows any authenticated user with Contributor role or higher to write arbitrary pagelayer_contact_templates metadata to posts—including unpublished drafts. The unauthenticated pagelayer_contact_submit endpoint later retrieves and processes this metadata based solely on user-supplied post and form identifiers, with no verification that the requesting client should have access to the template or that the post is in a publishable state. This creates a privilege escalation where low-privileged authenticated users can inject configuration that gets consumed by public endpoints. The vulnerability is classified under CWE-863 (Incorrect Authorization), and its impact is amplified when combined with CVE-2026-2442, which likely expands control over email behavior or delivery.

Business impact

An attacker with basic contributor access can reconfigure contact form email templates on any post they can edit, including pending drafts. This allows redirection or modification of customer inquiries and form submissions without administrator visibility. Email templates may be altered to harvest data, send responses to attacker-controlled addresses, inject phishing content, or execute downstream attacks via email chains. For business-critical websites using Pagelayer for customer contact, this represents a loss of control over communication integrity and potential data exfiltration from form submissions.

Affected systems

All versions of the Page Builder: Pagelayer plugin up to and including 2.0.9 are affected. The vulnerability requires WordPress to be installed and the Pagelayer plugin to be active. Exploitation requires an authenticated user account with at least Contributor-level permissions (or higher, such as Author or Editor). Sites using Pagelayer Pro are mentioned in the description as typically configuring the template feature via the UI, but the underlying vulnerable code path exists regardless of whether Pro features are licensed.

Exploitability

Exploitability is moderate. The vulnerability requires prior authentication and Contributor-level access—not available to anonymous users on restricted sites, but easily obtained on sites allowing user registration or open to internal teams. The attack vector is network-based and requires no user interaction beyond the attacker's own API calls. Once an attacker gains Contributor access (through registration, compromise, or insider threat), they can inject templates silently without needing to publish posts or trigger visible page builder UI, making detection harder. The CVSS score of 4.3 (Medium) reflects the authentication requirement but also the low impact scope (integrity only, no confidentiality or availability loss in isolation).

Remediation

Update the Pagelayer plugin to a patched version that enforces proper authorization checks on both the save and consume sides. The patch should either restrict pagelayer_contact_templates metadata to published posts only, require elevated privileges (Admin or Editor only) to set form templates, or enforce verification that the template was created by an authorized party before using it on the public-facing contact form endpoint. Verify the exact patched version against the official Pagelayer security advisory.

Patch guidance

Check the Pagelayer plugin repository or vendor advisory for a version released after 2.0.9 that addresses this authorization issue. Apply the update immediately in a staging environment first to confirm no custom contact form configurations are lost. After patching, audit any contact form templates created in the past 30–90 days (depending on your risk model) to ensure they have not been maliciously modified by lower-privileged users. For sites running Pagelayer Pro, verify that the patched version is compatible with your license and feature set.

Detection guidance

Monitor WordPress post metadata updates, particularly write operations targeting pagelayer_contact_templates. Log and alert on pagelayer_save_content AJAX requests from Contributor-level accounts, especially if they target posts not authored by that user. Baseline your legitimate contact form templates and watch for sudden changes in email recipients, subject lines, or other template fields. Correlate postmeta modifications with subsequent contact form submissions (pagelayer_contact_submit requests) to identify injected templates being consumed. Review user role assignments for unexpected Contributor promotions that might precede exploitation.

Why prioritize this

Prioritize patching in the following order: (1) sites that allow public user registration (higher risk of attacker gaining Contributor access), (2) sites with sensitive customer intake forms, (3) multi-author sites where Contributor accounts are common. The CVSS score is Medium, and KEV status is not applicable, so this is not in the active-exploitation tracking list. However, the ability to modify email templates silently and the chain potential with CVE-2026-2442 elevate business risk beyond the base score. Organizations with WordPress sites should treat this as a standard monthly patch priority.

Risk score, explained

The CVSS 3.1 score of 4.3 (Medium) reflects: Network-accessible vulnerability (AV:N), low attack complexity (AC:L), but requiring prior authentication and Contributor-level privileges (PR:L). The impact is limited to integrity (I:L)—specifically the integrity of outbound contact form emails—with no direct confidentiality or availability loss in isolation. The score does not account for business context or chaining potential, both of which amplify real-world risk. Organizations should consider raising their internal risk rating if they permit users to self-register as Contributors or if contact forms handle sensitive data.

Frequently asked questions