CVE-2026-24543: 
WordPress vulnerability analysis and mitigation

CVE-2026-24543 is a Missing Authorization (Broken Access Control) vulnerability in the Materialis Companion WordPress plugin by Horea Radu. It allows authenticated attackers with low privileges (Subscriber-level) to exploit incorrectly configured access control security levels. The vulnerability affects all versions of the plugin up to and including 1.3.52, with version 1.3.53 containing the fix. It was published on January 23, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before executing certain privileged actions. An attacker with at minimum a Subscriber-level WordPress account can send crafted requests to trigger functionality that should be restricted to higher-privileged roles. The flaw was discovered by security researcher Nabil Irawan and reported on December 25, 2025, before being published by Patchstack on January 24, 2026 (Patchstack).

Successful exploitation results in a low-integrity impact with no confidentiality or availability consequences, meaning an attacker can perform unauthorized write or modification actions within the WordPress site that should be restricted to higher-privileged users. The scope is limited to the affected WordPress installation and does not allow for remote code execution or data exfiltration based on current analysis. The practical risk is considered low by Patchstack, though such vulnerabilities are noted as being used in mass-exploit campaigns targeting large numbers of WordPress sites indiscriminately (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at least a Subscriber-level authenticated account on the target WordPress site, which limits opportunistic exploitation compared to unauthenticated vulnerabilities.

1. Reconnaissance: Identify WordPress sites running the Materialis Companion plugin version 1.3.52 or earlier using tools like WPScan or by checking the plugin's readme.txt file at wp-content/plugins/materialis-companion/readme.txt.
2. Obtain low-privilege access: Register or obtain a Subscriber-level account on the target WordPress site (many sites allow open registration).
3. Identify unprotected endpoints: Analyze the plugin's AJAX handlers or REST API endpoints that lack proper capability checks, which would normally require Editor or Administrator privileges.
4. Send crafted request: Authenticated as a Subscriber, send a crafted HTTP POST request to the vulnerable endpoint (e.g., via wp-admin/admin-ajax.php with the relevant action parameter) to trigger the restricted functionality.
5. Achieve unauthorized action: The missing authorization check allows the low-privileged request to execute, resulting in unauthorized modification of site content or settings (Patchstack).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/admin-ajax.php or REST API endpoints associated with the Materialis Companion plugin from low-privileged user accounts; repeated requests from the same Subscriber-level user to plugin-specific action handlers.
• File System: Unexpected modifications to WordPress content, theme settings, or plugin configuration files associated with the Materialis Companion plugin.
• Application: Unexplained changes to site customization settings or companion plugin configurations made by accounts that should not have such permissions.

The vendor has released version 1.3.53 of the Materialis Companion plugin, which resolves this vulnerability. Site administrators should update the plugin to version 1.3.53 or later immediately via the WordPress admin dashboard or by downloading the updated plugin from the WordPress plugin repository. As a temporary workaround if updating is not immediately possible, administrators can disable the Materialis Companion plugin or restrict site registration to prevent untrusted users from obtaining Subscriber-level accounts. Patchstack users can enable auto-update for vulnerable plugins to automate remediation (Patchstack).