Unauthorized Access Vulnerability in Mesmerize Companion Plugin for WordPress
CVE-2025-12027

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Mesmerize Companion
Vendor
CVE Published:
19 February 2026

What is CVE-2025-12027?

The Mesmerize Companion plugin for WordPress has a flaw that enables authenticated attackers with subscriber level access and above to exploit the functions 'openPageInCustomizer' and 'openPageInDefaultEditor'. This vulnerability arises from a missing capability check, allowing unauthorized manipulation of page content. Attackers can mark any page as maintainable, customize its layout with arbitrary sections, alter page metadata, and toggle the default editor setting without proper authorization. This poses a significant risk to website integrity, especially for those utilizing the Mesmerize theme.

Affected Version(s)

Mesmerize Companion 0 <= 1.6.158

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafshanzani Suhada
.