What the vulnerability does
01Description
The Betheme theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 26.5.1.4 via deserialization of untrusted input supplied via the import, mfn-items-import-page, and mfn-items-import parameters passed through the mfn_builder_import, mfn_builder_import_page, importdata, importsinglepage, and importfromclipboard functions. This makes it possible for authenticated attackers, with subscriber level permissions and above to inject a PHP Object. The additional presence of a POP chain would make it possible for attackers to execute code, retrieve sensitive data, delete files, etc..
Explanation of Vulnerability in Simple Terms
02Summary
Betheme versions up to 26.5.1.4 contain a deserialization vulnerability that allows authenticated users to execute arbitrary code on the site. An attacker with low-level access can craft malicious serialized data that, when processed by the theme, runs their own PHP code with full site privileges. This affects all installations using the vulnerable version range.
What an attacker can do
03Attacker Capabilities
Run arbitrary PHP code on the site with full administrative privileges.
Potential impact on your site
04Site Impact
A compromised user account can lead to complete site takeover, data theft, malware injection, or defacement.
Conditions required to exploit
05Prerequisites
Attacker must have a low-level user account (subscriber or above) on the WordPress site.
Key dates
06Disclosure timeline
November 21, 2022
CVE published
April 8, 2026
Record updated
