CVE-2023-3204: Materialis <= 1.1.24 - Missing Authorization to Limited Arbitrary Options Update
The Materialis theme for WordPress is vulnerable to limited arbitrary options updates in versions up to, and including, 1.1.24. This is due to missing authorization checks on the companiondisablepopup() function called via an AJAX action. This makes it possible for authenticated attackers, with minimal permissions such as subscribers, to modify any option on the site to a numerical value.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3204?
CVE-2023-3204 has a medium severity due to the potential for limited arbitrary options updates.
How do I fix CVE-2023-3204?
To fix CVE-2023-3204, update the Materialis theme to version 1.1.25 or later, where the vulnerability has been addressed.
Who is affected by CVE-2023-3204?
CVE-2023-3204 affects users of the Materialis theme for WordPress up to version 1.1.24.
What causes CVE-2023-3204?
CVE-2023-3204 is caused by missing authorization checks in the companion_disable_popup() function.
Can CVE-2023-3204 be exploited without authentication?
No, CVE-2023-3204 requires authentication to exploit the vulnerability.