CVE-2025-12027
Unauthorized Access in Mesmerize Companion Plugin via Missing Capability Check
Publication date: 2026-02-19
Last updated on: 2026-02-19
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mesmerize | mesmerize_companion | to 1.6.158 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'The Mesmerize Companion plugin for WordPress has a vulnerability due to missing capability checks on the functions "openPageInCustomizer" and "openPageInDefaultEditor" in all versions up to and including 1.6.158. This allows authenticated users with subscriber-level access or higher, on websites using the Mesmerize theme, to perform unauthorized actions such as marking arbitrary pages as maintainable, wrapping content in custom sections, changing page template metadata, and toggling the default editor flag without proper authorization.'}, {'type': 'paragraph', 'content': 'The vulnerability arises from insufficient nonce verification and lack of user capability checks in AJAX handlers, which could lead to unauthorized access and modification of page content and settings.'}] [1, 3]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'This vulnerability can allow an attacker with at least subscriber-level access to bypass normal permission restrictions and modify page content and settings without proper authorization.'}, {'type': 'list_item', 'content': 'Mark arbitrary pages as maintainable.'}, {'type': 'list_item', 'content': 'Wrap page content in custom sections.'}, {'type': 'list_item', 'content': 'Change page template metadata.'}, {'type': 'list_item', 'content': 'Toggle the default editor flag.'}, {'type': 'paragraph', 'content': "These unauthorized modifications could lead to content integrity issues, potential privilege escalation, and unauthorized customization of the website's appearance or behavior."}] [1, 3]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'Detection of this vulnerability involves checking if the Mesmerize Companion WordPress plugin is installed and running a vulnerable version (up to and including 1.6.158). Since the vulnerability allows unauthorized access via AJAX handlers like openPageInCustomizer() and openPageInDefaultEditor(), monitoring for suspicious AJAX requests to these endpoints can help detect exploitation attempts.'}, {'type': 'paragraph', 'content': 'You can check the plugin version by inspecting the plugin files or using WP-CLI commands.'}, {'type': 'list_item', 'content': 'Use WP-CLI to list installed plugins and their versions: wp plugin list'}, {'type': 'list_item', 'content': "Check for AJAX requests related to the vulnerable functions in your web server logs or via network monitoring tools by filtering requests containing 'openPageInCustomizer' or 'openPageInDefaultEditor'."}, {'type': 'list_item', 'content': 'Look for unauthorized changes in page metadata or templates, which may indicate exploitation.'}] [1, 3]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Mesmerize Companion plugin to version 1.6.1 (build 62) or later, where the vulnerability has been fixed by adding proper nonce verification and user capability checks.
If updating immediately is not possible, restrict access to the WordPress admin area to trusted users only, especially limiting subscriber-level users from accessing customization features.
Monitor and audit AJAX requests related to the vulnerable functions and consider implementing additional web application firewall (WAF) rules to block unauthorized requests targeting these endpoints.
Ensure that your WordPress installation and PHP environment meet the minimum version requirements enforced by the updated plugin to maintain security and stability.