Executive brief
Pagelayer, a popular website builder plugin for WordPress, contains a security flaw that allows lower-level users like Contributors to modify contact form settings. By exploiting this, an attacker can configure custom email templates that are then triggered by unsuspecting visitors submitting forms on the site. This could lead to unauthorized use of the website's email system for sending modified or malicious communications.
Technical details
The vulnerability exists in the pagelayer_save_content AJAX handler, which fails to properly restrict the persistence of pagelayer_contact_templates metadata. Users with basic post-edit capabilities (such as Contributors) can inject this metadata into posts they control. Subsequently, the unauthenticated pagelayer_contact_submit endpoint processes this metadata via user-supplied identifiers without verifying if the context is published or privileged. This allows an attacker to define arbitrary mail templates that are executed during unauthenticated form submissions. This vulnerability can be chained with other flaws to gain greater control over outbound email behavior.
Affected products
- Pagelayer Pagelayer – Drag and Drop website builder Up to and including 2.0.9
Timeline
- 2026-06-13: disclosed
- 2026-06-13: advisory