CVE-2022-3861: Betheme <= 26.5.1.4 - Authenticated (Subscriber+) PHP Object Injection
The Betheme theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 26.5.1.4 via deserialization of untrusted input supplied via the import, mfn-items-import-page, and mfn-items-import parameters passed through the mfnbuilderimport, mfnbuilderimportpage, importdata, importsinglepage, and importfromclipboard functions. This makes it possible for authenticated attackers, with subscriber level permissions and above to inject a PHP Object. The additional presence of a POP chain would make it possible for attackers to execute code, retrieve sensitive data, delete files, etc..
Other sources
The Betheme theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 26.5.1.4 via deserialization of untrusted input supplied via the import, mfn-items-import-page, and mfn-items-import parameters passed through the mfnbuilderimport, mfnbuilderimportpage, importdata, importsinglepage, and importfromclipboard functions. This makes it possible for authenticated attackers, with contributor level permissions and above to inject a PHP Object. The additional presence of a POP chain would make it possible for attackers to execute code, retrieve sensitive data, delete files, etc..
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/bethemeto a version that resolves this vulnerability.Fixed in 26.5.1.4 - Configuration
Ensure the import/mfn-items import parameters passed through mfn_builder_import, mfn_builder_import_page, importdata, importsinglepage, and importfromclipboard are not controllable by authenticated users below the required trust level (e.g., block contributor/subscriber+ access to these import features).
WordPress Betheme importer endpoints mfn_builder_import / mfn_builder_import_page / importdata / importsinglepage / importfromclipboard parameters (import, mfn-items-import-page, mfn-items-import) = Restrict to trusted, authenticated admin-only usage; prevent untrusted user-controlled submission
Event History
Frequently Asked Questions
What is CVE-2022-3861?
CVE-2022-3861 is a vulnerability in the Betheme theme for WordPress that allows for PHP Object Injection.
What is the severity of CVE-2022-3861?
CVE-2022-3861 has a severity rating of high (8.8).
How does CVE-2022-3861 affect the Betheme theme for WordPress?
CVE-2022-3861 affects versions up to and including 26.5.1.4 of the Betheme theme for WordPress via deserialization of untrusted input supplied via specific parameters.
How can I fix CVE-2022-3861 in the Betheme theme for WordPress?
To fix CVE-2022-3861, users should update their Betheme theme to version 26.6 or higher.
Where can I find more information about CVE-2022-3861?
More information about CVE-2022-3861 can be found in the official security advisory provided by Muffingroup and the Wordfence vulnerability advisories.