CVE-2022-45356: 
WordPress vulnerability analysis and mitigation

Missing Authorization vulnerability affects Muffingroup Betheme WordPress theme versions through 26.6.1. The vulnerability was discovered and reported by Dave Jong, and was assigned CVE-2022-45356. The issue specifically relates to broken access control in the theme's functionality (Patchstack).

The vulnerability is classified as a Missing Authorization issue (CWE-862) where the mfnvb_init_vb() function lacks proper authorization checks. This allows attackers with privileges as low as Subscriber to perform unauthorized actions. The vulnerability has received a CVSS v3.1 base score of 8.8 (HIGH) from NIST NVD and 5.4 (MEDIUM) from Patchstack (NVD, WPScan).

The vulnerability allows attackers with low-privileged access (Subscriber level) to perform unauthorized actions within the WordPress installation. This represents a significant broken access control issue that could potentially lead to unauthorized data access or modifications (Patchstack).

The vulnerability is known to be exploited in the wild. The attack vector is network-accessible (AV:N) with low attack complexity (AC:L) and requires low privileges (PR:L) with no user interaction (UI:N) (Patchstack).

The vulnerability has been fixed in Betheme version 26.6.3. Users are strongly advised to update to this version or later to resolve the security issue. For those unable to update immediately, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks (Patchstack).