CVE-2026-24543: Materialis Companion Auth Bypass Flaw

CVE-2026-24543 Overview

CVE-2026-24543 is a Missing Authorization vulnerability [CWE-862] in the Horea Radu Materialis Companion plugin for WordPress. The flaw exists in versions up to and including 1.3.52. The plugin exposes functionality protected by incorrectly configured access control checks, enabling authenticated users with low privileges to invoke actions they should not reach. The Common Vulnerabilities and Exposures (CVE) record was published on January 23, 2026, and last modified on April 28, 2026.

Critical Impact
Authenticated users with minimal permissions can interact with restricted plugin functionality, leading to limited integrity impact on affected WordPress sites running Materialis Companion through version 1.3.52.

Affected Products

Horea Radu Materialis Companion (materialis-companion) plugin for WordPress
All versions from initial release through 1.3.52
WordPress sites that install and activate the plugin

Discovery Timeline

2026-01-23 - CVE-2026-24543 published to the National Vulnerability Database (NVD)
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-24543

Vulnerability Analysis

The vulnerability is a Broken Access Control issue classified under [CWE-862] Missing Authorization. The Materialis Companion plugin exposes one or more handlers that perform privileged operations without verifying that the calling user has the required capability. An attacker who already holds a low-privileged authenticated session, such as a Subscriber or Contributor, can invoke these handlers directly. The result is limited integrity impact on the WordPress instance. The Exploit Prediction Scoring System (EPSS) currently rates the likelihood of exploitation as low, and no public proof-of-concept code is referenced in the advisory.

Root Cause

The root cause is a missing or incorrectly configured authorization check in plugin endpoints. WordPress plugins commonly enforce access control through current_user_can() capability checks combined with nonce verification using check_ajax_referer() or wp_verify_nonce(). In Materialis Companion versions up to 1.3.52, at least one privileged action path lacks an adequate capability check, allowing any authenticated user to reach functionality intended for administrators.

Attack Vector

Exploitation requires network access to the WordPress site and an authenticated session with low privileges. No user interaction beyond the attacker is required. The attacker sends a crafted HTTP request to the vulnerable plugin endpoint, typically admin-ajax.php or a REST route registered by the plugin. Because the endpoint does not validate the user's role, the request is processed as if it came from a privileged user. The attack does not require elevated privileges beyond a registered account, which is significant on sites that allow open user registration.

No verified exploit code has been published. Refer to the Patchstack Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-24543

Indicators of Compromise

Unexpected POST requests to wp-admin/admin-ajax.php containing Materialis Companion action parameters originating from low-privileged user sessions
Modifications to plugin or theme settings without a corresponding administrator login event in the audit log
New or altered site customization records committed by non-administrator accounts

Detection Strategies

Enumerate installed WordPress plugins and flag any host running materialis-companion at version 1.3.52 or earlier
Correlate WordPress user role data with admin-ajax.php request logs to identify privileged actions executed by Subscriber or Contributor accounts
Alert on HTTP 200 responses to plugin AJAX actions that should be restricted to administrators

Monitoring Recommendations

Forward WordPress access logs and authentication events to a centralized logging platform for retention and correlation
Enable a WordPress audit plugin to record user role, capability, and request path for every administrative action
Monitor for sudden creation of new low-privileged accounts followed by immediate calls to plugin endpoints

How to Mitigate CVE-2026-24543

Immediate Actions Required

Update Materialis Companion to a version later than 1.3.52 once the vendor publishes a fixed release
Audit existing WordPress user accounts and remove or downgrade unused low-privileged accounts
Disable open user registration on sites that do not require it by unchecking Anyone can register under Settings > General

Patch Information

No fixed version is identified in the NVD record at the time of publication. The advisory states the issue affects Materialis Companion from n/a through <= 1.3.52. Administrators should monitor the Patchstack Vulnerability Report and the plugin's WordPress.org listing for an updated release.

Workarounds

Deactivate the Materialis Companion plugin until a patched version is available if the plugin is not essential
Restrict access to wp-admin/admin-ajax.php and plugin REST routes using a Web Application Firewall (WAF) rule that blocks requests from non-administrator sessions
Apply a virtual patch through a WordPress security plugin that enforces capability checks on plugin AJAX actions

bash

# Example: block low-privileged access to the plugin's AJAX handler via .htaccess IP allowlist
<Files "admin-ajax.php">
    Require ip 203.0.113.0/24
</Files>