CVE-2022-3861

The Betheme theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 26.5.1.4 via deserialization of untrusted input supplied via the import, mfn-items-import-page, and mfn-items-import parameters passed through the mfn_builder_import, mfn_builder_import_page, importdata, importsinglepage, and importfromclipboard functions. This makes it possible for authenticated attackers, with subscriber level permissions and above to inject a PHP Object. The additional presence of a POP chain would make it possible for attackers to execute code, retrieve sensitive data, delete files, etc..

• CWE-502
• CWE-502

• https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2022-3861.txtExploit, Third Party Advisory
• https://muffingroup.com/betheme/Product
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f5e984d5-2537-4a4a-a071-084e0c1c3b5e?source=cve
• https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3861Third Party Advisory
• https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2022-3861.txtExploit, Third Party Advisory
• https://muffingroup.com/betheme/Product
• https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3861Third Party Advisory

Published

Nov 21, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-38599Teleport v3.2.2, Teleport v3.5.6-rc6, and Teleport v3.6.3-b2…6.5
• CVE-2022-3860The Visual Email Designer for WooCommerce WordPress plugin b…8.8
• CVE-2022-38600Mplayer SVN-r38374-13.0.1 is vulnerable to Memory Leak via v…5.5
• CVE-2022-38604Wacom Driver 6.3.46-1 for Windows and lower was discovered t…7.3
• CVE-2022-38605Church Management System v1.0 was discovered to contain a SQ…7.2
• CVE-2022-38606Garage Management System v1.0 was discovered to contain a SQ…7.2
• CVE-2022-38610Garage Management System v1.0 was discovered to contain a SQ…7.2
• CVE-2022-38611Incorrect access control in Watchdog Anti-Virus v1.4.158 all…7.8
• CVE-2022-38613A Path Traversal vulnerability in SmartVista Cardgen v3.28.0…6.5
• CVE-2022-38614An issue in the IGB Files and OutfileService features of Sma…7.5
• CVE-2022-38615SmartVista SVFE2 v2.2.22 was discovered to contain multiple …8.8
• CVE-2022-38616SmartVista SVFE2 v2.2.22 was discovered to contain a SQL inj…8.8