Description
The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 (Mesmerize) and 1.0.172 (Materialis). This is due to 'companion_disable_popup' function only checking the nonce while sending user input to the 'update_option' function. This makes it possible for authenticated attackers to change otherwise restricted options.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
extendthemes Materialis
Default version status: unaffected
0 to ≤ 1.0.172affected
extendthemes Mesmerize
Default version status: unaffected
0 to ≤ 1.6.89affected
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8c9c3302-47cd-4dbe-b79e-5e6032928074?source=cve ↗
- https://blog.nintechnet.com/wordpress-mesmerize-and-materialis-themes-fixed-an-authenticated-options-change-vulnerability/ ↗
- https://wpscan.com/vulnerability/e4d70f03-69d5-4cca-8300-985f68d19ddc ↗
- https://wordpress.org/themes/mesmerize/ ↗
- https://wordpress.org/themes/materialis/ ↗
- https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=121291%40mesmerize&new=121291%40mesmerize&sfp_email=&sfph_mail= ↗
- https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=121290%40materialis&new=121290%40materialis&sfp_email=&sfph_mail= ↗