CVE-2026-2470 is an incorrect authorization vulnerability in the Page Builder: Pagelayer WordPress plugin affecting all versions up to and including 2.0.9. The vulnerability stems from the pagelayer_save_content AJAX handler allowing users with basic post-edit permissions to save pagelayer_contact_templates metadata on posts they can edit, including pending posts. The unauthenticated pagelayer_contact_submit endpoint later uses this metadata without enforcing privilege or published post status checks. This flaw enables authenticated attackers with Contributor-level access or higher to create arbitrary contact-form mail templates that unauthenticated users can submit, potentially leading to misuse of the contact form feature. The vulnerability may be chained with CVE-2026-2442 to enhance exploitability and attacker control over outbound email functionality.

The vulnerability allows authenticated users with Contributor-level or higher privileges to create arbitrary contact-form mail templates that unauthenticated users can submit. This could lead to unauthorized use of the contact form feature, potentially enabling abuse such as sending emails through the vulnerable system. There is no direct confidentiality or availability impact reported. The issue may be leveraged in combination with another vulnerability (CVE-2026-2442) to increase attacker control over outbound email behavior.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor-level and higher user permissions carefully and monitor for unusual contact form activity. Avoid relying on the pagelayer_contact_templates feature if possible. No official fix or temporary workaround has been documented at this time.