The vulnerability is an authorization bypass that allows authenticated users with subscriber or higher access to invoke functions that should be restricted. The openPageInCustomizer and openPageInDefaultEditor functions lack proper capability checks, permitting those users to mark arbitrary pages as maintainable, wrap content in custom sections, change page template metadata, and toggle the default editor flag without proper authorization. These actions modify site configuration and could be used to deface the site, alter content presentation, or create a foothold for further attacks.

The issue affects the Mesmerize Companion WordPress plugin for all versions up to and including 1.6.158 from the vendor horearadu. It is relevant to any WordPress installation that has the Mesmerize theme activated and the plugin installed.

The CVSS score is 4.3, indicating a moderate severity. The EPSS score is < 1 %, suggesting a low probability of widespread exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires the attacker to first authenticate to the WordPress site with a subscriber‑level or higher account; once logged in, the attacker can invoke the vulnerable functions, either through the admin interface or via the REST API, to modify page settings without authorization.