What is the CVSS score of CVE-2026-39469?

CVE-2026-39469 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Pagelayer CVE-2026-39469

Q: Which versions of Pagelayer are affected by CVE-2026-39469?

Softaculous PageLayer WordPress plugin through version 2.0.8 allows authenticated users to retrieve embedded sensitive data through exposure of information to an unauthorized control sphere.

EUVD-2026-20139 MEDIUM

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2026-04-08 Patchstack

GHSA-pr8q-fpgr-cjrr

WordPress Information Disclosure Pagelayer Wordpress Plugin Softaculous

4.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 20:09 vuln.today

CVSS changed

Apr 14, 2026 - 16:22 NVD

4.3 (MEDIUM)

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20139

CVE Published

Apr 08, 2026 - 08:30 nvd

N/A

DescriptionCVE.org

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Softaculous PageLayer pagelayer allows Retrieve Embedded Sensitive Data.This issue affects PageLayer: from n/a through <= 2.0.8.

AnalysisAI

Softaculous PageLayer WordPress plugin through version 2.0.8 allows authenticated users to retrieve embedded sensitive data through exposure of information to an unauthorized control sphere. The vulnerability has a low CVSS score of 4.3 and an extremely low EPSS percentile of 5%, indicating minimal real-world exploitation probability despite requiring authenticated access. No active exploitation or public exploit code has been identified at time of analysis.

Technical ContextAI

The vulnerability stems from CWE-497, which describes exposure of sensitive system information to an unauthorized control sphere-a design flaw where sensitive data is made accessible to parties beyond the intended authorization boundary. In the context of the Softaculous PageLayer plugin (a WordPress page builder), this likely involves improper access controls or data leakage in API endpoints, shortcodes, or stored metadata that allow authenticated users with limited privileges to read data intended for higher-privilege roles or external systems. The affected product is identified by CPE cpe:2.3:a:softaculous:pagelayer:*:*:*:*:*:*:*:*, spanning all versions from inception through 2.0.8.

RemediationAI

Update Softaculous PageLayer to a version newer than 2.0.8 (patch version not explicitly specified in provided data, recommend checking Patchstack advisory and Softaculous official repository for the exact patched release). If immediate update is not possible, review and restrict WordPress user roles and capabilities to ensure authenticated users cannot access page builder features, metadata, or API endpoints intended for administrators. Audit any PageLayer installations for unauthorized data exposure in database metadata, shortcode attributes, or API responses, and consider implementing additional access control checks or data sanitization if custom PageLayer extensions are deployed. For detailed advisory information, consult the Patchstack database entry at https://patchstack.com/database/Wordpress/Plugin/pagelayer/vulnerability/wordpress-pagelayer-plugin-2-0-8-sensitive-data-exposure-vulnerability?_s_id=cve.