The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress contains an authorization flaw in the pagelayer_save_content() function, preventing proper access control checks on content submissions. Consequently, authenticated users with Contributor level or higher can bypass the moderation process and publish posts directly, thereby compromising content integrity and potentially allowing malicious or inappropriate material to appear on the site. This weakness is categorized as CWE-862, indicating insufficient authorization controls.

The vulnerability applies to all installations of the Pagelayer plugin for WordPress running version 1.9.8 or earlier. The plugin is distributed under the vendor Softaculous and is commonly found in WordPress environments that use the Drag and Drop website builder component.

The CVSS score of 4.3 reflects a moderate severity, while the EPSS score of less than 1% indicates a low likelihood of widespread exploitation at present. The flaw is not listed in the CISA KEV catalog. Attackers would need legitimate access to the WordPress admin interface with Contributor or higher capabilities; no remote code execution or privilege escalation outside the WordPress application layer is required. Once authenticated, an attacker can send a payload to the pagelayer_save_content endpoint and cause the system to publish a post, effectively altering site content without permission.