CVE-2026-2470 is an incorrect authorization vulnerability in the Page Builder: Pagelayer WordPress plugin versions up to 2.0.9. The pagelayer_save_content AJAX handler permits users with basic post-edit capabilities (Contributor-level and above) to persist pagelayer_contact_templates metadata on posts they can edit, including pending posts. The unauthenticated pagelayer_contact_submit endpoint later consumes this metadata without enforcing privilege or published-context boundaries, enabling attackers to configure arbitrary contact-form mail templates that can be triggered via unauthenticated submissions. This backend trust path exists despite typical configuration being done via the Pagelayer Pro UI. The vulnerability has a CVSS 3.1 score of 4.3 (medium severity) and can be chained with CVE-2026-2442 to enhance exploitability and control over outbound email behavior.

Authenticated users with Contributor-level access or higher can create arbitrary contact-form mail templates that unauthenticated attackers can then exploit to submit forms using these templates. This could lead to unauthorized use of contact forms, potentially facilitating spam or other misuse of the email functionality. There is no direct confidentiality or availability impact indicated. The vulnerability may be leveraged in combination with CVE-2026-2442 to increase attacker control over outbound email behavior.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch has been indicated in the provided data. Until a patch is available, restrict Contributor-level access where possible and monitor for updates from the vendor or plugin maintainers regarding a fix.