High severity8.8NVD Advisory· Published Nov 21, 2022· Updated Apr 8, 2026
CVE-2022-3861
CVE-2022-3861
Description
The Betheme theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 26.5.1.4 via deserialization of untrusted input supplied via the import, mfn-items-import-page, and mfn-items-import parameters passed through the mfn_builder_import, mfn_builder_import_page, importdata, importsinglepage, and importfromclipboard functions. This makes it possible for authenticated attackers, with subscriber level permissions and above to inject a PHP Object. The additional presence of a POP chain would make it possible for attackers to execute code, retrieve sensitive data, delete files, etc..
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
4- github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2022-3861.txtnvdExploitThird Party Advisory
- www.wordfence.com/vulnerability-advisories-continued/nvdThird Party Advisory
- muffingroup.com/betheme/nvdProduct
- www.wordfence.com/threat-intel/vulnerabilities/id/f5e984d5-2537-4a4a-a071-084e0c1c3b5envd
News mentions
0No linked articles in our index yet.