CVE-2025-12366: 
WordPress vulnerability analysis and mitigation

CVE-2025-12366 is an Insecure Direct Object Reference (IDOR) vulnerability in the Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress. It affects all versions up to and including 2.0.5, and was published on November 13, 2025. The flaw allows authenticated attackers with Author-level access or higher to replace media files belonging to other users, including administrators. It carries a CVSS v3.1 base score of 4.3 (Medium) (RedHat CVE, Wordfence).

The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key) and resides in the pagelayer_replace_page function within the plugin's replace-media.php file. Due to missing validation on a user-controlled key, an authenticated attacker can supply an arbitrary media file ID belonging to another user — including an administrator — and overwrite it with their own content. The attack vector is network-based, requires low privileges (Author role), no user interaction, and has low attack complexity (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated attacker with Author-level access to replace media files owned by any other user on the WordPress site, including administrators. This compromises site integrity by enabling unauthorized modification of content assets (images, documents, etc.) without the owner's knowledge. There is no direct confidentiality or availability impact, but tampered media could be used for defacement, phishing, or social engineering within the site context (Wordfence, Sucuri Blog).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-12366. The EPSS score is approximately 0.025% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid WordPress account with at least Author-level privileges, limiting the attacker pool (Wordfence, RedHat CVE).

1. Reconnaissance: Identify a WordPress site running the Pagelayer plugin at version 2.0.5 or earlier (e.g., by checking the plugin's readme.txt or generator meta tags).
2. Obtain Author-level access: Register or compromise an account with at least the WordPress Author role on the target site.
3. Identify target media file: Browse the WordPress media library or enumerate attachment IDs (e.g., via the REST API at /wp-json/wp/v2/media) to find a media file owned by an administrator or another user.
4. Craft malicious request: Send an authenticated HTTP request to the endpoint invoking pagelayer_replace_page, supplying the target user's media attachment ID as the user-controlled key parameter along with a replacement file.
5. Overwrite media file: Due to missing authorization validation, the server replaces the target user's media file with the attacker-supplied content, achieving unauthorized content modification (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing authenticated POST requests to Pagelayer's replace-media endpoint (replace-media.php or equivalent AJAX action) with attachment IDs not owned by the requesting user.
• File System: Unexpected changes to media files in wp-content/uploads/ — particularly files owned by administrators being modified by lower-privileged accounts; check file modification timestamps against expected activity.
• WordPress Activity Logs: If an activity logging plugin is installed, look for media replacement events attributed to Author-level users targeting files owned by other users.
• Database: Changes in the wp_posts table for post_type = 'attachment' where the post_modified timestamp does not align with the owning user's activity (Wordfence).

The vulnerability is fixed in Pagelayer version 2.0.6 and later, which adds proper authorization validation on the user-controlled key in the pagelayer_replace_page function. Site administrators should update the plugin immediately via the WordPress dashboard or by downloading the latest version from the WordPress plugin repository. As a temporary workaround, restricting Author-level user accounts or disabling the Pagelayer plugin until patching is feasible can reduce risk (Wordfence, WordPress Trac Changeset).

Wordfence disclosed the vulnerability and included it in their weekly WordPress vulnerability report for November 10–16, 2025, noting the patch availability in version 2.0.6 (Wordfence Blog). Sucuri also covered it in their November 2025 vulnerability patch roundup, highlighting it as part of a broader set of WordPress plugin issues addressed that month (Sucuri Blog). No significant social media controversy or broader media coverage has been observed, consistent with the vulnerability's medium severity rating.