CVE-2024-2694: Betheme <= 27.5.6 - Authenticated (Contributor+) PHP Object Injection
The Betheme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 27.5.6 via deserialization of untrusted input of the 'mfn-page-items' post meta value. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2694?
CVE-2024-2694 is classified as a high-severity vulnerability due to its potential for exploitation through PHP Object Injection.
How do I fix CVE-2024-2694?
To remediate CVE-2024-2694, update the Betheme theme for WordPress to version 27.5.7 or later.
Who is affected by CVE-2024-2694?
CVE-2024-2694 affects all versions of the Betheme theme for WordPress up to and including 27.5.6.
What kind of attack can exploit CVE-2024-2694?
CVE-2024-2694 can be exploited by authenticated attackers with contributor-level access to perform PHP Object Injection.
Is there a way to mitigate CVE-2024-2694 if I can't update immediately?
If you cannot update immediately, consider restricting contributor-level access to reduce the risk of exploitation for CVE-2024-2694.