Contributor remote code execution in Muffingroup Betheme

Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions.

• Patchstack's current advisory lists Betheme versions <= 28.5.7 as affected and identifies 28.5.8 as patched.
• The supplied CVE record still lists Betheme with default status unaffected and an affected boundary of n/a through <= 28.4.2 using a custom version type.
• Because the current CNA advisory provides a newer and broader boundary, use <= 28.5.7 for operational triage. Repackaged deployments, parallel branches, and other distribution formats are not established by the available evidence and should be verified separately.

The flaw is classified as CWE-94, improper control of generated code, in the Betheme theme. Available evidence identifies Contributor privileges as the access condition, but does not disclose the specific endpoint, parameter, function, or code path that processes attacker-controlled input.

At a high level, an authenticated Contributor could submit specially crafted data through a network-reachable theme function; if that data is handled unsafely during code generation, attacker-controlled code could execute. This is a non-weaponized, high-level description inferred from the disclosed weakness class and attack conditions, not an exploit procedure.

The record describes network reachability, low attack complexity, low privileges, and no need for another user's interaction. The impact scope is marked as changed, but the implementation detail explaining how execution crosses the Betheme component boundary has not been disclosed.

Available evidence describes network exploitation by an authenticated account with Contributor privileges, with low complexity and no required interaction from another user. The supplied record marks public exploit as false, while known exploited is not set; therefore the available data does not confirm observed exploitation or a publicly available exploit. A returned enrichment record carries an exploitation status of none and an automatable status of no, but those are scoped assessments and do not prove that abuse has not occurred elsewhere. Patchstack warns that the vulnerability may become exploited, but that warning is not evidence of a confirmed campaign.

The flaw may allow a Contributor account to execute code in the WordPress server environment, resulting in loss of website confidentiality, integrity, and availability. An attacker could potentially read or alter data, modify content and configuration, establish persistence, or disrupt service, depending on process permissions and deployment configuration.

Exploitation requires Contributor privileges but does not require another user's interaction. The record describes changed impact scope, so effects may extend beyond the theme's own processing, but the available details are insufficient to identify the exact affected components or establish lateral movement.

Successful exploitation could allow an attacker to execute code in the server-side WordPress environment, potentially exposing, modifying, or deleting website data, changing configuration, or disrupting service.

That access could support defacement, malicious content injection, account changes, or impact to other components reachable by the WordPress process. The actual consequences depend on the server process permissions, hosting configuration, and data accessible from the site.

The record does not confirm a breach, data loss, or named attack campaign. Websites that permit Contributor logins should nevertheless receive priority review because the required access is below administrator level.

1. Update Betheme to 28.5.8 or later according to Patchstack's current guidance. This is the primary remediation.
2. If an immediate update is not possible, deploy Patchstack's mitigation rule to temporarily block attacks, while treating the rule as temporary protection rather than a code fix.
3. After updating, verify that every website, staging site, restored backup, and container copy uses the patched release, rather than checking only one theme directory.
4. Review Contributor accounts, authentication logs, and unexpected file or content changes. If compromise is suspected, isolate the site under the incident response process and rotate credentials that the WordPress process could access.

1. Inventory WordPress sites using Betheme and identify the deployed theme version, including copies in staging environments, backups, and containers.
2. Compare inventory results with the affected and patched boundaries in affected_summary, prioritizing sites that permit Contributor logins.
3. Review Contributor accounts, unexpected privilege assignments, and accounts that are no longer required. This reduces attack surface but is not a vulnerability-specific indicator.
4. Review web server, PHP, and WordPress logs for unusual post-authentication requests, activity invoking Betheme functionality outside normal behavior, or unexpected changes to the theme and site content. No specific endpoint, parameter, or IOC has been disclosed for this issue.
5. If compromise is suspected, check theme file integrity, newly created administrator accounts, scheduled tasks, and unusual server processes. The absence of matching log evidence does not establish that a system is safe.