CVE-2025-1926 is a Cross-Site Request Forgery (CWE-352) vulnerability affecting the Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress. The issue is due to missing or incorrect nonce validation in the pagelayer_save_post function, which allows an attacker to forge requests that modify post content if an administrator is tricked into clicking a malicious link. This affects all versions up to and including 1.9.8. The vulnerability has a CVSS 3.1 base score of 4.3, indicating medium severity. There is no indication of known exploits in the wild or an available patch at this time.

An unauthenticated attacker can exploit this vulnerability by tricking a site administrator into performing an action such as clicking a crafted link, which results in unauthorized modification of post contents. The impact is limited to integrity loss of post data. There is no direct confidentiality or availability impact reported. The vulnerability requires user interaction (UI:R) and no privileges (PR:N) but can be executed remotely (AV:N).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when interacting with untrusted links and consider limiting administrative access or using additional security plugins that provide CSRF protection. Monitor official softaculous or plugin vendor channels for updates and apply patches promptly once released.