Page Builder: Pagelayer Insecure Direct Object Reference Vulnerability Allowing Media Replacement

A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in the Page Builder: Pagelayer WordPress plugin, in all versions through 2.0.5. The issue arises in the 'pagelayer_replace_page' function, where insufficient validation on a user-controlled key allows authenticated attackers with Author-level access or higher to replace media files belonging to other users, including administrators.

Impact

Exploitation of this vulnerability allows for unauthorized replacement of media files, potentially leading to misuse of media assets or disruption of content.

Remediation

Users are advised to update the Page Builder: Pagelayer plugin to version 2.0.6 or a newer patched version.