CVE-2019-25142

· HIGHModified

← All CVEs

CVSS v3.1

8.8

EPSS

1.31%

Published

Jun 6, 2023

Modified

Apr 8, 2026

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 (Mesmerize) and 1.0.172 (Materialis). This is due to 'companion_disable_popup' function only checking the nonce while sending user input to the 'update_option' function. This makes it possible for authenticated attackers to change otherwise restricted options.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-862CWE-862

Affected Products (2)

extendthemes · materialis (up to 1.0.173)vulnerable

extendthemes · mesmerize (up to 1.6.90)vulnerable

References (14)

https://blog.nintechnet.com/wordpress-mesmerize-and-materialis-themes-fixed-an-authenticated-options-change-vulnerability/

ExploitTechnical DescriptionThird Party Advisory

https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=121290%40materialis&new=121290%40materialis&sfp_email=&sfph_mail=

PatchRelease Notes