200K sites with buggy WordPress plugin exposed to wipe attacks

Two flaws in the PageLayer plugin could be exploited to escalate privileges and forge an administrator request to change site settings, enabling malicious Javascript injection.