CVE-2025-12027 | BDVDB-2026-316021 Detail
horearaduMesmerize Companion
Description#
The Mesmerize Companion plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the "openPageInCustomizer" and "openPageInDefaultEditor" functions in all versions up to, and including, 1.6.158. This makes it possible for authenticated attackers - with subscriber level access and above, on websites with the Mesmerize theme activated - to mark arbitrary pages as maintainable, wrap their content in custom sections, change page template metadata, and toggle the default editor flag without proper authorization.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact low, availability impact none. Attack vector: network.
Weaknesses#
- CWE-862 Missing Authorization
References#
- https://www.wordfence.com/threat-intel/vulnerabilities/id/242a3c60-b8ca-43cc-92d7-eb3830381512?source=cve
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3385651%40mesmerize-companion&old=3270403%40mesmerize-companion&sfp_email=&sfph_mail=
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3385651%40mesmerize-companion&new=3385651%40mesmerize-companion&sfp_email=&sfph_mail=
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.