Vulnerabilities > CVE-2019-25142 - Missing Authorization vulnerability in Extendthemes Materialis and Mesmerize

CVSS 8.8 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

extendthemes

CWE-862

NVD

Published: 2023-06-07

Updated: 2024-11-21

Summary

The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 (Mesmerize) and 1.0.172 (Materialis). This is due to 'companion_disable_popup' function only checking the nonce while sending user input to the 'update_option' function. This makes it possible for authenticated attackers to change otherwise restricted options.

Vulnerable Configurations

Part	Description	Count
Application	Extendthemes Extendthemes Materialis - Extendthemes Materialis 0.9.29 Extendthemes Materialis 1.0.5 Extendthemes Materialis 1.0.6 Extendthemes Materialis 1.0.7 Extendthemes Materialis 1.0.8 Extendthemes Materialis 1.0.9 Extendthemes Materialis 1.0.10 Extendthemes Materialis 1.0.13 Extendthemes Materialis 1.0.96 Extendthemes Materialis 1.0.98 Extendthemes Materialis 1.0.99 Extendthemes Materialis 1.0.100 Extendthemes Materialis 1.0.102 Extendthemes Materialis 1.0.103 Extendthemes Materialis 1.0.104 Extendthemes Materialis 1.0.105 Extendthemes Materialis 1.0.163 Extendthemes Materialis 1.0.164 Extendthemes Materialis 1.0.167 Extendthemes Materialis 1.0.168 Extendthemes Materialis 1.0.171 Extendthemes Materialis 1.0.172 Extendthemes Mesmerize 0.1 Extendthemes Mesmerize 0.9.1 Extendthemes Mesmerize 0.9.2 Extendthemes Mesmerize 0.9.4 Extendthemes Mesmerize 0.9.5 Extendthemes Mesmerize 0.9.6 Extendthemes Mesmerize 0.9.7 Extendthemes Mesmerize 0.9.8 Extendthemes Mesmerize 0.9.9 Extendthemes Mesmerize 0.9.10 Extendthemes Mesmerize 0.9.11 Extendthemes Mesmerize 1.0.65 Extendthemes Mesmerize 1.0.66 Extendthemes Mesmerize 1.0.72 Extendthemes Mesmerize 1.0.73 Extendthemes Mesmerize 1.0.86 Extendthemes Mesmerize 1.0.90 Extendthemes Mesmerize 1.1.0 Extendthemes Mesmerize 1.1.1 Extendthemes Mesmerize 1.1.2 Extendthemes Mesmerize 1.1.3 Extendthemes Mesmerize 1.1.4 Extendthemes Mesmerize 1.2 Extendthemes Mesmerize 1.2.1 Extendthemes Mesmerize 1.2.2 Extendthemes Mesmerize 1.5.42 Extendthemes Mesmerize 1.5.45 Extendthemes Mesmerize 1.5.50 Extendthemes Mesmerize 1.5.52 Extendthemes Mesmerize 1.6.59 Extendthemes Mesmerize 1.6.61 Extendthemes Mesmerize 1.6.62 Extendthemes Mesmerize 1.6.72 Extendthemes Mesmerize 1.6.77 Extendthemes Mesmerize 1.6.81 Extendthemes Mesmerize 1.6.82 Extendthemes Mesmerize 1.6.85 Extendthemes Mesmerize 1.6.88 Extendthemes Mesmerize 1.6.89	62

Common Weakness Enumeration (CWE)

CWE-862 - Missing Authorization

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References