The Pagelayer Drag and Drop website builder plugin for WordPress is exposed to an Insecure Direct Object Reference flaw that allows authenticated users with Author permissions or higher to call the pagelayer_replace_page function without proper validation. This flaw enables those users to replace media files belonging to other users, including administrators, thereby modifying site content, potentially inserting malicious media, or defacing the website. The primary impact is the integrity of uploaded files rather than confidentiality or availability.

Softaculous distributes the Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress. All released versions up to and including 2.0.5 are affected. The vulnerability exists in the plugin code that processes media replacement requests.

The CVSS score of 4.3 classifies this issue as moderate severity. EPSS is reported as < 1%, indicating a very low probability of exploitation in the near term, and the vulnerability is not listed in the CISA KEV catalog. However, because the flaw requires an authenticated user with Author or higher privileges, the actual risk depends on the user base and permission model of the affected site. The attack vector is internal, leveraging legitimate user credentials to trigger the insecure function.