Access violation vulnerability in Page Builder: Pagelayer – Drag and Drop website builder 1.9.8

The Page Builder plugin for WordPress, called Pagelayer, has a security issue that could expose information. This problem affects all versions up to and including 1.9.8. The vulnerability is found in the ‘pagelayer_builder_posts_shortcode’ function, which doesn’t have enough restrictions on which posts can be used. This means that someone who is logged in and has Contributor-level access or higher could access private posts that they should not be able to see.