What’s Vulnerable › Vulnerabilities
CVE-2019-25142: Mesmerize <= 1.6.89 & Materialis <= 1.0.172 - Authenticated Arbitrary Options Update
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.3% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2023-06-07 · updated 2026-06-17
- Weakness: CWE-862
Description
The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 (Mesmerize) and 1.0.172 (Materialis). This is due to 'companion_disable_popup' function only checking the nonce while sending user input to the 'update_option' function. This makes it possible for authenticated attackers to change otherwise restricted options.
Affected products
- extendthemes Materialis: before 1.0.173 — fixed in 1.0.173
- extendthemes Mesmerize: before 1.6.90 — fixed in 1.6.90
How to fix
Upgrade to a fixed version: extendthemes Materialis 1.0.173; extendthemes Mesmerize 1.6.90. Check the vendor advisory for mitigations.
References
- https://blog.nintechnet.com/wordpress-mesmerize-and-materialis-themes-fixed-an-authenticated-options-change-vulnerability/
- https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=121290%40materialis&new=121290%40materialis&sfp_email=&sfph_mail=
- https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=121291%40mesmerize&new=121291%40mesmerize&sfp_email=&sfph_mail=
- https://wordpress.org/themes/materialis/
- https://wordpress.org/themes/mesmerize/
- https://wpscan.com/vulnerability/e4d70f03-69d5-4cca-8300-985f68d19ddc
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8c9c3302-47cd-4dbe-b79e-5e6032928074?source=cve
- https://blog.nintechnet.com/wordpress-mesmerize-and-materialis-themes-fixed-an-authenticated-options-change-vulnerability/
- https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=121290%40materialis&new=121290%40materialis&sfp_email=&sfph_mail=
- https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=121291%40mesmerize&new=121291%40mesmerize&sfp_email=&sfph_mail=
- https://wordpress.org/themes/materialis/
- https://wordpress.org/themes/mesmerize/
Get alerted when CVE-2019-25142 or the next vulnerability affects your stack