What the vulnerability does
01Description
The Mesmerize Companion plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the "openPageInCustomizer" and "openPageInDefaultEditor" functions in all versions up to, and including, 1.6.158. This makes it possible for authenticated attackers - with subscriber level access and above, on websites with the Mesmerize theme activated - to mark arbitrary pages as maintainable, wrap their content in custom sections, change page template metadata, and toggle the default editor flag without proper authorization.
Explanation of Vulnerability in Simple Terms
02Summary
Mesmerize Companion versions up to 1.6.158 lack proper authorization checks, allowing authenticated users to modify content they should not have access to. An attacker with a low-privilege account can alter data without proper permission validation. The vulnerability affects the integrity of site content but does not expose sensitive information or cause service disruption.
What an attacker can do
03Attacker Capabilities
Modify content or settings they should not have permission to change.
Potential impact on your site
04Site Impact
Unauthorized users can alter site content, requiring content audits and potential restoration from backups.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site.
Key dates
06Disclosure timeline
February 19, 2026
CVE published
April 8, 2026
Record updated
