CVE-2019-25142

Katalog CVE

CVSS 8.8 · High EPSS 1,3%

Kerentanan Missing Authorization pada extendthemes materialis, extendthemes mesmerize. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 (Mesmerize) and 1.0.172 (Materialis). This is due to 'companion_disable_popup' function only checking the nonce while sending user input to the 'update_option' function. This makes it possible for authenticated attackers to change otherwise restricted options.

Rincian

Terbit di NVD

7 Juni 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 69,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=121290%40materialis&new=121290... patch · release notes
• https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=121291%40mesmerize&new=121291%... patch · release notes
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8c9c3302-47cd-4dbe-b79e-5e6032928074?source=cve patch · advisory pihak ketiga
• https://blog.nintechnet.com/wordpress-mesmerize-and-materialis-themes-fixed-an-authenticated-options-change-vu... exploit · deskripsi teknis · advisory pihak ketiga
• https://wpscan.com/vulnerability/e4d70f03-69d5-4cca-8300-985f68d19ddc advisory pihak ketiga
• https://wordpress.org/themes/materialis/ product
• https://wordpress.org/themes/mesmerize/ product