Briefly, they found two different vulnerabilities in the plugin.
The first of these is a high-severity bug with a CVSS score of 7.4. It existed because of the absence of permission checks on all AJAX endpoints in the plugin. Hence, a user with any level of access to the site could perform any actions. As stated in the post,
These AJAX endpoints only checked to see if a request was coming from /wp-admin through an authenticated session and did not check the capabilities of the user sending the request.Even a subscriber-level user could gain access to the site and meddle with site contents. This includes deleting the content or injecting malicious content to the existing pages.
The second vulnerability, also a high-severity bug with a CVSS score of 8.8, existed due to the absence of CSRF protection. Hence an adversary could inject malicious scripts to the site pages, that would execute whenever someone would visit the page.
Consequently, they implemented permission checks on all functions linked with site changes and added nonces for separate public and admin access. Besides, they implemented CSRF protection addressing the second vulnerability.
The developers released both the fixes with Page Builder: PageLayer version 1.1.2. Since then, they have made further improvements as well. Hence the latest version now available is 1.1.4. Users should ensure upgrading to this plugin version at the earliest to receive all the updates.
