Exploitation Research Plan: CVE-2026-24543 (Materialis Companion)

1. Vulnerability Summary

The Materialis Companion plugin (<= 1.3.52) contains a missing authorization vulnerability within its AJAX handlers. Specifically, the function responsible for dismissing admin notices (and potentially other administrative tasks) does not perform a current_user_can() check. This allows any authenticated user, including those with Subscriber privileges, to perform actions intended for Administrators, such as dismissing site-wide notifications.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: materialis_companion_dismiss_notice (inferred from typical Extend Themes patterns)
• HTTP Method: POST
• Parameters:
  • action: materialis_companion_dismiss_notice
  • notice_id: The ID of the notice to dismiss (e.g., install_theme_notice)
  • nonce: A valid WordPress nonce for the action.
• Authentication: Required (Subscriber-level or higher).

3. Code Flow (Inferred)

1. Registration: The plugin registers the AJAX handler in its main class (likely Materialis\Companion or within materialis-companion.php):

   add_action( 'wp_ajax_materialis_companion_dismiss_notice', array( $this, 'dismiss_notice' ) );
   

2. Execution: When the admin-ajax.php endpoint is hit with the specific action:
   • The dismiss_notice() function is called.
   • It likely calls check_ajax_referer( 'materialis_companion_nonce', 'nonce' ).
   • Vulnerability: It fails to call current_user_can( 'manage_options' ).
   • The function proceeds to update a WordPress option (e.g., materialis_companion_dismissed_notices) using the provided notice_id.

4. Nonce Acquisition Strategy

The Materialis Companion plugin enqueues administrative scripts that localize a nonce for use in its AJAX calls. This nonce is available to any user with access to the WordPress dashboard (including Subscribers).

1. Trigger Script Loading: The script is typically loaded on all /wp-admin/ pages.
2. Access Dashboard: Navigate to /wp-admin/index.php as a Subscriber.
3. Extract Nonce:
   • Use browser_eval to extract the nonce from the global JavaScript object localized by the plugin.
   • Variable Name: materialis_companion_object (inferred)
   • Key: nonce
   • Command: browser_eval("window.materialis_companion_object?.nonce")

5. Exploitation Strategy

Step 1: Authentication

Authenticate as a Subscriber user to obtain valid session cookies.

Step 2: Nonce Extraction

Navigate to the dashboard and extract the materialis_companion_nonce.

Step 3: Malicious Request

Send an unprivileged POST request to dismiss a notice.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Body:

  action=materialis_companion_dismiss_notice&nonce=[EXTRACTED_NONCE]&notice_id=security_update_warning
  

6. Test Data Setup

1. Target User: Create a Subscriber-level user.

   wp user create attacker attacker@example.com --role=subscriber --user_pass=password
   

2. Plugin Setup: Ensure materialis-companion version 1.3.52 is installed and active.
3. Verification State: Ensure there are no entries in the dismissed notices option yet.

   wp option get materialis_companion_dismissed_notices
   

7. Expected Results

• The server should respond with a successful status code (likely 200 OK or a JSON {"success": true}).
• Even though the user is a Subscriber, the request will be processed.
• The notice_id will be added to the list of dismissed notices, affecting what Administrators see.

8. Verification Steps

After the exploit request, use WP-CLI to check if the data was modified:

# Check if the notice ID was added to the dismissed notices option
wp option get materialis_companion_dismissed_notices

If the option now contains security_update_warning, the unauthorized modification was successful.

9. Alternative Approaches

If materialis_companion_dismiss_notice is not the exact identifier, audit the plugin's main file for other wp_ajax_ hooks lacking current_user_can:

1. grep -r "wp_ajax_" .
2. Look for functions like materialis_companion_install_plugin or materialis_companion_activate_plugin.
3. If materialis_companion_install_plugin is present, use a payload like:
   action=materialis_companion_install_plugin&nonce=[NONCE]&slug=akismet
   This would be a higher-severity manifestation of the same "Missing Authorization" flaw.