Mesmerize <= 1.6.89 & Materialis <= 1.0.172 - Authenticated Arbitrary Options Update
Published Jun 7, 2023
8.8
HIGHCVSS 3.1
EPSS 1.31%
Description
The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 (Mesmerize) and 1.0.172 (Materialis). This is due to 'companion_disable_popup' function only checking the nonce while sending user input to the 'update_option' function. This makes it possible for authenticated attackers to change otherwise restricted options.
Affected products
-
- Version 0StatusaffectedConstraints<=1.0.172
- Version
-
- Version 0StatusaffectedConstraints<=1.6.89
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Extendthemes | Materialis | unaffected |
| ||||||
| Extendthemes | Mesmerize | unaffected |
|
- < 1.0.173
- < 1.6.90
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
NoTechnical Impact
TotalDecision
n/aAssessed Dec 23, 2024 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
2023–2026- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (16 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 1.31% (0.01310) | 69.59th | v5 (v2026.06.15) |
| Jun 15, 2026 | 1.31% (0.01310) | 66.80th | v5 (v2026.06.15) |
| Jun 13, 2026 | 1.72% (0.01717) | 82.86th | v4 (v2025.03.14) |
| Nov 21, 2025 | 0.44% (0.00440) | 62.39th | v4 (v2025.03.14) |
| Nov 18, 2025 | 1.72% (0.01718) | 80.88th | v4 (v2025.03.14) |
| Mar 30, 2025 | 0.44% (0.00440) | 60.23th | v4 (v2025.03.14) |
| Mar 29, 2025 | 4.06% (0.04060) | 80.57th | v4 (v2025.03.14) |
| Mar 24, 2025 | 0.44% (0.00440) | 60.33th | v4 (v2025.03.14) |
| Mar 23, 2025 | 4.06% (0.04060) | 86.39th | v4 (v2025.03.14) |
| Mar 17, 2025 | 0.40% (0.00402) | 58.73th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.26% (0.00259) | 66.07th | v3 (v2023.03.01) |
| Jun 26, 2024 | 0.22% (0.00219) | 60.14th | v3 (v2023.03.01) |
| Jun 13, 2024 | 0.20% (0.00201) | 58.25th | v3 (v2023.03.01) |
| May 7, 2024 | 0.13% (0.00126) | 46.84th | v3 (v2023.03.01) |
| Jun 15, 2023 | 0.11% (0.00108) | 42.60th | v3 (v2023.03.01) |
| Jun 7, 2023 | 0.04% (0.00044) | 8.35th | v3 (v2023.03.01) |
References (7)
- https://blog.nintechnet.com/wordpress-mesmerize-and-materialis-themes-fixed-an-authenticated-options-change-vulnerability/ ExploitTechnical DescriptionThird Party Advisory
- https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=121290%40materialis&new=121290%40materialis&sfp_email=&sfph_mail= PatchRelease Notes
- https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=121291%40mesmerize&new=121291%40mesmerize&sfp_email=&sfph_mail= PatchRelease Notes
- https://wordpress.org/themes/materialis/ Product
- https://wordpress.org/themes/mesmerize/ Product
- https://wpscan.com/vulnerability/e4d70f03-69d5-4cca-8300-985f68d19ddc Third Party Advisory
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8c9c3302-47cd-4dbe-b79e-5e6032928074?source=cve PatchThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| https://blog.nintechnet.com/wordpress-mesmerize-and-materialis-themes-fixed-an-authenticated-options-change-vulnerability/ | ExploitTechnical DescriptionThird Party Advisory | |
| https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=121290%40materialis&new=121290%40materialis&sfp_email=&sfph_mail= | PatchRelease Notes | |
| https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=121291%40mesmerize&new=121291%40mesmerize&sfp_email=&sfph_mail= | PatchRelease Notes | |
| https://wordpress.org/themes/materialis/ | Product | |
| https://wordpress.org/themes/mesmerize/ | Product | |
| https://wpscan.com/vulnerability/e4d70f03-69d5-4cca-8300-985f68d19ddc | Third Party Advisory | |
| https://www.wordfence.com/threat-intel/vulnerabilities/id/8c9c3302-47cd-4dbe-b79e-5e6032928074?source=cve | PatchThird Party Advisory |
Change history (0)
No recorded changes yet.