CVE-2025-12366 is an insecure direct object reference vulnerability in the Page Builder: Pagelayer WordPress plugin. The vulnerability exists due to insufficient validation of a user-controlled key parameter in the pagelayer_replace_page function, enabling authenticated users with Author-level privileges or above to replace media files owned by other users, including administrators. This can lead to unauthorized modification of media content. The issue affects all versions up to and including 2.0.5. No known exploits are reported in the wild, and no patch or remediation details have been provided by the vendor.

An attacker with Author-level or higher access can replace media files belonging to other users, including administrators, potentially leading to unauthorized content modification. There is no indication of confidentiality or availability impact. The vulnerability is rated medium severity with a CVSS score of 4.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level access to trusted users only and monitor for suspicious activity related to media file modifications. Avoid granting unnecessary privileges to users to reduce risk.