Atomic Edge analysis of CVE-2025-12027 (metadata-based):
This vulnerability is a missing authorization flaw in the Mesmerize Companion WordPress plugin, affecting versions up to and including 1.6.158. The flaw allows any authenticated user, including those with the low-privilege subscriber role, to modify page settings and metadata when the Mesmerize theme is active. The CVSS score of 4.3 (Medium) reflects a low integrity impact with no confidentiality or availability loss.

Atomic Edge research identifies the root cause as a missing capability check on the `openPageInCustomizer` and `openPageInDefaultEditor` functions. The CWE-862 classification confirms the absence of a proper authorization mechanism before performing sensitive actions. Without access to the source code diff, this conclusion is inferred from the CWE and the vulnerability description. The plugin likely registers these functions as AJAX handlers or admin-post actions without verifying the user has the `edit_posts` or `edit_pages` capability.

Exploitation requires an authenticated session. An attacker with subscriber credentials sends a crafted POST request to the WordPress AJAX endpoint (`/wp-admin/admin-ajax.php`). The request targets the vulnerable action, which Atomic Edge infers is named `mesmerize_companion_open_page_in_customizer` or a similar variant based on the plugin slug and function names. The payload includes parameters like `page_id` to target an arbitrary page and likely a `template` or `editor` flag to modify the metadata. No nonce check is present, as its absence is part of the vulnerability.

The remediation in version 1.6.162 likely added proper capability checks using `current_user_can()` within the vulnerable functions. The patch also likely introduced nonce verification for the AJAX requests to prevent CSRF. These are standard fixes for missing authorization vulnerabilities in WordPress plugins and are inferred from the CWE and common patching patterns.

Successful exploitation impacts data integrity. Attackers can mark arbitrary pages as maintainable, wrap page content in custom sections, alter page template metadata, and toggle the default editor flag. This could disrupt site layout, break page functionality, or create inconsistencies in the page management interface. The vulnerability does not lead to privilege escalation, remote code execution, or direct data exposure.