CVE-2026-2470

{"id": "CVE-2026-2470", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2470", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-15T13:40:09.581954Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "softaculous", "product": "Page Builder: Pagelayer \u2013 Drag and Drop website builder", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.0.9"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-13T08:16:12.030", "references": [{"url": "https://plugins.trac.wordpress.org/changeset/3506022/pagelayer", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ef926bc7-b50f-40ac-9ace-7e01b26f34e1?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "The Page Builder: Pagelayer \u2013 Drag and Drop website builder plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to, and including, 2.0.9. This is due to the pagelayer_save_content AJAX handler allowing users with basic post-edit capability to persist pagelayer_contact_templates metadata on posts they can edit (including pending posts), while the unauthenticated pagelayer_contact_submit endpoint later consumes that metadata by user-controlled post/form identifiers without enforcing a privileged or published-context boundary. This makes it possible for authenticated attackers, with Contributor-level access and above, to configure arbitrary contact-form mail templates that are usable through unauthenticated form submission via the contacts parameter. In typical deployments this template feature is configured via Pagelayer Pro UI; however, the vulnerable backend trust path is still present. This issue may be chained with CVE-2026-2442 to increase exploitability and attacker control over outbound email behavior."}, {"lang": "es", "value": "El constructor de p\u00e1ginas: Pagelayer - plugin de creaci\u00f3n de sitios web de arrastrar y soltar para WordPress es vulnerable a una autorizaci\u00f3n incorrecta en todas las versiones hasta la 2.0.9, inclusive. Esto se debe a que el gestor AJAX pagelayer_save_content permite a los usuarios con capacidad b\u00e1sica de edici\u00f3n de publicaciones persistir metadatos de pagelayer_contact_templates en publicaciones que pueden editar (incluidas las publicaciones pendientes), mientras que el endpoint no autenticado pagelayer_contact_submit consume posteriormente esos metadatos mediante identificadores de publicaci\u00f3n/formulario controlados por el usuario sin aplicar un l\u00edmite de contexto privilegiado o publicado. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, configuren plantillas de correo de formulario de contacto arbitrarias que son utilizables mediante el env\u00edo de formularios no autenticados a trav\u00e9s del par\u00e1metro contacts. En implementaciones t\u00edpicas, esta caracter\u00edstica de plantilla se configura a trav\u00e9s de la interfaz de usuario de Pagelayer Pro; sin embargo, la ruta de confianza vulnerable del backend sigue presente. Este problema puede encadenarse con CVE-2026-2442 para aumentar la explotabilidad y el control del atacante sobre el comportamiento del correo electr\u00f3nico saliente."}], "lastModified": "2026-07-23T09:10:00.113", "sourceIdentifier": "security@wordfence.com"}