The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Cross‑Site Request Forgery because the pagelayer_save_post function does not perform proper nonce validation. This flaw allows an attacker who can trick a site administrator into clicking a crafted link or submitting a forged request to modify the contents of any post that the administrator can edit. The attacker does not need any credentials and can therefore inject or alter content remotely.

WordPress sites that have installed the Page Builder: Pagelayer – Drag and Drop website builder plugin from Softaculous, in any version up to and including 1.9.8. The vulnerability is present in all versions in that range and would affect all installations using those plugin releases.

The CVSS score of 4.3 indicates a low overall severity, and the EPSS score of less than 1% suggests a very low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Attacks would typically involve a malicious link that forces a logged‑in administrator to submit a form, so the attack vector is user interaction with a forged request. While the risk is modest, an uncompromised administrator account grants the attacker the ability to tamper with site content.