CVE-2020-35947 describes a critical vulnerability in the PageLayer plugin for WordPress versions prior to 1.1.2. The flaw stems from insufficient permission checks on numerous AJAX endpoints, allowing any authenticated user to execute these actions, notably the pagelayer_save_content function. This vulnerability carries a CVSS score of 7.4 (HIGH), indicating it can be exploited remotely with low complexity by a low-privileged user, potentially leading to cross-site scripting (XSS), content modification, and other impacts. While no active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB) has been identified, and community discussion is minimal, the potential for unauthorized content manipulation and XSS remains a significant concern.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.1.2CPE matchmatch criteria | cpe:2.3:a:pagelayer:pagelayer:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.