CVE-2019-25142: Mesmerize <= 1.6.89 & Materialis <= 1.0.172 - Authenticated Arbitrary Options Update
The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 (Mesmerize) and 1.0.172 (Materialis). This is due to 'companiondisablepopup' function only checking the nonce while sending user input to the 'updateoption' function. This makes it possible for authenticated attackers to change otherwise restricted options.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-25142?
CVE-2019-25142 is considered a medium severity vulnerability due to potential impact on website configurations.
How do I fix CVE-2019-25142?
To fix CVE-2019-25142, update the Mesmerize theme to version 1.6.90 or higher and the Materialis theme to version 1.0.173 or higher.
Who is affected by CVE-2019-25142?
CVE-2019-25142 affects users of the Mesmerize and Materialis themes for WordPress versions up to 1.6.89 and 1.0.172 respectively.
What causes CVE-2019-25142?
CVE-2019-25142 is caused by the 'companion_disable_popup' function not properly validating user input before calling the 'update_option' function.
Is CVE-2019-25142 an authenticated vulnerability?
Yes, CVE-2019-25142 requires user authentication to exploit, making it an authenticated options change vulnerability.