What the vulnerability does
01Description
The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Improper Neutralization of CRLF Sequences ('CRLF Injection') in all versions up to, and including, 2.0.7. This is due to the contact form handler performing placeholder substitution on attacker-controlled form fields and then passing the resulting values into email headers without removing CR/LF characters. This makes it possible for unauthenticated attackers to inject arbitrary email headers (for example Bcc / Cc) and abuse form email delivery via the 'email' parameter granted they can target a contact form configured to use placeholders in mail template headers.
Explanation of Vulnerability in Simple Terms
02Summary
Pagelayer page builder versions up to 2.0.7 contain an integrity vulnerability allowing network-based modification of data without authentication. The flaw requires no user interaction and affects the application's data integrity. Site administrators should update to a version newer than 2.0.7 to remediate this issue.
What an attacker can do
03Attacker Capabilities
Modify data or content on the site without needing to log in.
Potential impact on your site
04Site Impact
Attackers can alter page content, settings, or other data without credentials.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required.
Key dates
06Disclosure timeline
March 28, 2026
CVE published
April 8, 2026
Record updated
