CVE-2025-2104 is a missing authorization vulnerability (CWE-862) in the Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress. The issue arises from inadequate validation in the pagelayer_save_content() function, allowing authenticated users with Contributor-level privileges or above to bypass post moderation and publish content directly. This affects all versions up to and including 1.9.8. The vulnerability has a medium severity rating with a CVSS 3.1 base score of 4.3 (Network attack vector, Low attack complexity, Low privileges required, No user interaction, Unchanged scope, No confidentiality or availability impact, but integrity impact is low).

Authenticated users with Contributor-level access or higher can bypass post moderation controls and publish posts directly, potentially allowing unauthorized content publication on affected WordPress sites using the vulnerable plugin. There is no indication of confidentiality or availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, site administrators should consider restricting Contributor-level access or disabling the plugin if post moderation bypass poses a risk. Monitor vendor channels for updates and apply patches promptly once available.