Themes Vulnerabilities

Mesmerize & Materialis Themes - Authenticated Options Update

Description

Discovered by NinTechNet, both the Mesmerize and Materialis WordPress themes were affected by an authenticated options update vulnerability. This could allow a lower privileged user to update site options, which they should not be permitted to.

Affects Themes

mesmerize
Fixed in 1.6.90
materialis
Fixed in 1.0.173

References

CVE
CVE-2019-25142
URL
https://blog.nintechnet.com/wordpress-mesmerize-and-materialis-themes-fixed-an-authenticated-options-change-vulnerability/

Miscellaneous

Original Researcher
NinTechNet
Verified
No
WPVDB ID
e4d70f03-69d5-4cca-8300-985f68d19ddc

Timeline

Publicly Published
2019-12-02 (about 6 years ago)
Added
2019-12-02 (about 6 years ago)
Last Updated
2023-06-08 (about 2 years ago)

Other

Published
Title
Published
2024-10-28
Title
Marketing Automation by AZEXO <= 1.27.80 - Authenticated (Subscriber+) Privilege Escalation
Published
2017-05-03
Title
WordPress 2.3-4.8.3 - Host Header Injection in Password Reset
Published
2023-04-25
Title
WordPress Vertical Image Slider < 1.2.17 - Reflected Cross-Site Scripting
Published
2014-08-01
Title
IndiaNIC FAQs Manager 1.0 - CAPTCHA Value Disclosure
Published
2023-09-09
Title
ProfilePress < 4.13.2 - Limited Privilege Escalation via 'acceptable_defined_roles'