Betheme theme vulnerable to PHP Object Injection

CVE-2024-2694

Summary

The Betheme theme for WordPress is susceptible to a PHP Object Injection vulnerability across all versions up to and including 27.5.6. This issue arises from the deserialization of untrusted input originating from the 'mfn-page-items' post meta value. Authenticated attackers with contributor-level access or higher can exploit this flaw to inject malicious PHP objects. While no known payload object graph (POP) chain exists in the vulnerable plugin itself, the presence of a POP chain through additional plugins or themes installed on the target system could enable attackers to perform various actions, including deleting arbitrary files, accessing sensitive data, or executing unauthorized code.

References