{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24543", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-01-23T12:31:46.853Z", "datePublished": "2026-01-23T14:28:52.349Z", "dateUpdated": "2026-04-28T16:14:48.901Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "materialis-companion", "product": "Materialis Companion", "vendor": "Horea Radu", "versions": [{"changes": [{"at": "1.3.53", "status": "unaffected"}], "lessThanOrEqual": "1.3.52", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-22T14:20:56.283Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in Horea Radu Materialis Companion materialis-companion allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Materialis Companion: from n/a through <= 1.3.52.</p>"}], "value": "Missing Authorization vulnerability in Horea Radu Materialis Companion materialis-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Materialis Companion: from n/a through <= 1.3.52."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:48.901Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/materialis-companion/vulnerability/wordpress-materialis-companion-plugin-1-3-52-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress Materialis Companion plugin <= 1.3.52 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-27T16:53:28.113276Z", "id": "CVE-2026-24543", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T14:20:39.290Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24543", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-27T16:53:28.113276Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T16:53:24.720Z"}}], "cna": {"title": "WordPress Materialis Companion plugin <= 1.3.52 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Horea Radu", "product": "Materialis Companion", "versions": [{"status": "affected", "changes": [{"at": "1.3.53", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "1.3.52"}], "packageName": "materialis-companion", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-22T14:20:56.283Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/materialis-companion/vulnerability/wordpress-materialis-companion-plugin-1-3-52-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Horea Radu Materialis Companion materialis-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Materialis Companion: from n/a through <= 1.3.52.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in Horea Radu Materialis Companion materialis-companion allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Materialis Companion: from n/a through <= 1.3.52.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-23T14:14:06.050Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24543", "state": "PUBLISHED", "dateUpdated": "2026-04-28T14:20:39.290Z", "dateReserved": "2026-01-23T12:31:46.853Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-01-23T14:28:52.349Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Horea Radu Materialis Companion materialis-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Materialis Companion: from n/a through <= 1.3.52."}, {"lang": "es", "value": "Vulnerabilidad de autorizaci\u00f3n faltante en Horea Radu Materialis Companion materialis-companion permite explotar niveles de seguridad de control de acceso incorrectamente configurados. Este problema afecta a Materialis Companion: desde n/a hasta &lt;= 1.3.52."}], "id": "CVE-2026-24543", "lastModified": "2026-04-28T15:16:12.327", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "audit@patchstack.com", "type": "Secondary"}]}, "published": "2026-01-23T15:16:10.637", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/materialis-companion/vulnerability/wordpress-materialis-companion-plugin-1-3-52-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-16T01:48:29.776818+00:00", "value": {"mitigation_remediation": ["Apply the latest Materialis Companion release that includes the patch for the access control flaw", "Verify that the plugin\u2019s administrative functions are only accessible to roles with the required capabilities, such as Administrator or Editor", "Restrict direct access to the plugin\u2019s configuration pages by reviewing WordPress user roles and applying the principle of least privilege"], "summary": {"action": "Apply Patch", "impact": "Unauthorized Access to Plugin Settings"}, "threat_synthesis": {"affected_systems": "The vulnerability affects WordPress sites that use the Materialis Companion plugin by Horea Radu, specifically all releases up to and including version\u202f1.3.52. No minimum version is stated, so any earlier releases are also potentially vulnerable until patched.", "description_and_impact": "Missing Authorization in Horea Radu Materialis Companion allows an attacker to bypass the plugin\u2019s intended access controls, potentially exposing functions that should be limited to privileged users. The weakness is classified as CWE\u2011862, leading to unauthorized modification or viewing of plugin configuration and content. This can compromise site integrity and confidentiality without requiring elevated privileges at the system level.", "risk_and_exploitability": "The CVSS base score of 4.3 indicates moderate risk, and the EPSS score of less than\u202f1\u202f% shows a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, suggesting it is not a widely exploited vulnerability at present. Attackers could reach the exposed functionality through normal authenticated requests once logged in as any user, leveraging the insufficient authorization checks. The implication is that a compromised or unauthenticated account with basic WordPress login can manipulate plugin settings."}}}}, "created": "2026-01-26T11:52:59.667618+00:00", "updated": "2026-04-16T02:00:12.321264+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}