The pagelayer_save_content AJAX handler allows users with basic post‑edit capability to persist contact‑form templates in the post metadata. These templates are later consumed by an unauthenticated pagelayer_contact_submit endpoint that does not enforce a privileged or published‑context boundary, enabling an authenticated contributor or higher user to configure arbitrary mail relay templates. The result is the potential for spamming, phishing, or otherwise abusing the plugin’s outbound email functionality. The weakness is a classic Incorrect Authorization issue identified as CWE‑863.

Softaculous Page Builder – Pagelayer plugin for WordPress, versions up to and including 2.0.9. No other versions are listed as affected.

The CVSS score of 4.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an authenticated contributor‑level user with the ability to edit posts, including pending ones. The attacker crafts an AJAX request to persist a custom contact‑form template and then triggers the unauthenticated endpoint via the contacts parameter to send outbound mail using the configured template. The vulnerability may be chained with CVE‑2026‑2442, which could expand the attacker’s control over outbound email behavior.