{"vulnerability": "CVE-2022-3747", "sightings": [{"uuid": "c847c9e8-1743-42fa-9121-9513c4daad97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3747", "type": "seen", "source": "https://t.me/cibsecurity/53683", "content": "\u203c CVE-2022-3747 \u203c\n\nThe Becustom plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5.2. This is due to missing nonce validation when saving the plugin's settings. This makes it possible for unauthenticated attackers to update the plugin's settings like betheme_url_slug, replaced_theme_author, and betheme_label to name a few, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-11-30T00:29:39.000000Z"}, {"uuid": "0d27e4e5-78a2-4b27-91cf-3896a5b28eaa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3747", "type": "seen", "source": "https://t.me/hacking_Attack/76669", "content": "Exploit Collector\nWordPress BeTheme BeCustom 1.0.5.2 Cross Site Request Forgery\n\nhttps://2.bp.blogspot.com/-QZ2Sf2sxziM/WWlvZhEG73I/AAAAAAAAIO0/d0s8s4TXkHwnfXzbpubNEBqDxa568NQgwCLcBGAs/s1600/h60.png \nWordPress BeTheme BeCustom plugin versions 1.0.5.2 and below suffer from a cross site request forgery vulnerability.\n\nSHA-256 | 651b396c90687b1931dfce7d1f9402a1dff09a912ce895903c27111b0634e43e\n\nDownload\nRCE Security Advisory\nhttps://www.rcesecurity.com\n1. ADVISORY INFORMATION\n=======================\nProduct:        BeCustom Wordpress Plugin\nVendor URL:     https://muffingroup.com/betheme/features/be-custom/\nType:           Cross-Site Request Forgery [CWE-253]\nDate found:     2021-10-28\nDate published: 2022-11-10\nCVSSv3 Score:   5.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N)\nCVE:            CVE-2022-3747\n2. CREDITS\n==========\nThis vulnerability was discovered and researched by Julien Ahrens from\nRCE Security.\n3. VERSIONS AFFECTED\n====================\nBeTheme BeCustom 1.0.5.2 and below\n4. INTRODUCTION\n===============\nBuilt in-house add-on, perfect for agencies and web developers will let you rebrand\nBe & WordPresss Admin to your own product by replacing all the Be & Muffin logos with\nown.\n\nThis tool is supplied exclusively to the customers of Betheme and allows for changes\nlike: complete dashboard customization, replacement of logos, colors managment and much\nmore. With just a few clicks, you will turn the Be & Muffin brand into yours, thanks to\nwhich you will increase the trust of your customers.\n\nMoreover, from now on you can also customize the WPLogin page.\n\n(from the vendor's homepage)\n5. VULNERABILITY DETAILS\n========================\nThe WordPress plugin lacks an anti-CSRF protection on all of its functionalities, which\nultimately allows an attacker to (amongst others):\n\n- Set custom brandings\n- Enable/Disable BeCustom features\n- Modify the WP Login view\n- Modify the BeDashboard texts\n\nSince there is no anti-CSRF token protecting these functionalities, they are\nvulnerable to Cross-Site Request Forgery attacks allowing an attacker to perform\na variety of attacks as mentioned above.\n\nTo successfully exploit this vulnerability, a user with the right to access the\nplugin must be tricked into visiting an arbitrary website while having an authenticated\nsession in the application.\n6. PROOF OF CONCEPT\n===================\nAn exemplary exploit to reset the plugin's configuration:\n7. SOLUTION\n===========\nUpdate to BeCustom 1.0.5.3\n8. REPORT TIMELINE\n==================\n2022-10-28: Discovery of the vulnerability\n2022-10-28: CVE requested from Wordfence (CNA)\n2022-10-28: Wordfence assigns CVE-2022-3747\n2022-11-01: Vendor notification\n2022-11-07: No response. Sent another notification.\n2022-11-08: Opened up a security support case on envato.com\n2022-11-xx: Vendor publishes version 1.0.5.3 without notification which fixes this issue\n2022-11-10: Public disclosure\n9. REFERENCES\n=============\nhttps://github.com/MrTuxracer/advisories\n\nSource:packetstormsecurity.com\n\u2796 Sent by @TheFeedReaderBot \u2796\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:17.234283Z"}, {"uuid": "a2d3deb2-e9a7-4ff2-8671-a79666c7fc12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3747", "type": "seen", "source": "https://t.me/hacking_Attack/76669", "content": "Exploit Collector\nWordPress BeTheme BeCustom 1.0.5.2 Cross Site Request Forgery\n\nhttps://2.bp.blogspot.com/-QZ2Sf2sxziM/WWlvZhEG73I/AAAAAAAAIO0/d0s8s4TXkHwnfXzbpubNEBqDxa568NQgwCLcBGAs/s1600/h60.png \nWordPress BeTheme BeCustom plugin versions 1.0.5.2 and below suffer from a cross site request forgery vulnerability.\n\nSHA-256 | 651b396c90687b1931dfce7d1f9402a1dff09a912ce895903c27111b0634e43e\n\nDownload\nRCE Security Advisory\nhttps://www.rcesecurity.com\n1. ADVISORY INFORMATION\n=======================\nProduct:        BeCustom Wordpress Plugin\nVendor URL:     https://muffingroup.com/betheme/features/be-custom/\nType:           Cross-Site Request Forgery [CWE-253]\nDate found:     2021-10-28\nDate published: 2022-11-10\nCVSSv3 Score:   5.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N)\nCVE:            CVE-2022-3747\n2. CREDITS\n==========\nThis vulnerability was discovered and researched by Julien Ahrens from\nRCE Security.\n3. VERSIONS AFFECTED\n====================\nBeTheme BeCustom 1.0.5.2 and below\n4. INTRODUCTION\n===============\nBuilt in-house add-on, perfect for agencies and web developers will let you rebrand\nBe & WordPresss Admin to your own product by replacing all the Be & Muffin logos with\nown.\n\nThis tool is supplied exclusively to the customers of Betheme and allows for changes\nlike: complete dashboard customization, replacement of logos, colors managment and much\nmore. With just a few clicks, you will turn the Be & Muffin brand into yours, thanks to\nwhich you will increase the trust of your customers.\n\nMoreover, from now on you can also customize the WPLogin page.\n\n(from the vendor's homepage)\n5. VULNERABILITY DETAILS\n========================\nThe WordPress plugin lacks an anti-CSRF protection on all of its functionalities, which\nultimately allows an attacker to (amongst others):\n\n- Set custom brandings\n- Enable/Disable BeCustom features\n- Modify the WP Login view\n- Modify the BeDashboard texts\n\nSince there is no anti-CSRF token protecting these functionalities, they are\nvulnerable to Cross-Site Request Forgery attacks allowing an attacker to perform\na variety of attacks as mentioned above.\n\nTo successfully exploit this vulnerability, a user with the right to access the\nplugin must be tricked into visiting an arbitrary website while having an authenticated\nsession in the application.\n6. PROOF OF CONCEPT\n===================\nAn exemplary exploit to reset the plugin's configuration:\n7. SOLUTION\n===========\nUpdate to BeCustom 1.0.5.3\n8. REPORT TIMELINE\n==================\n2022-10-28: Discovery of the vulnerability\n2022-10-28: CVE requested from Wordfence (CNA)\n2022-10-28: Wordfence assigns CVE-2022-3747\n2022-11-01: Vendor notification\n2022-11-07: No response. Sent another notification.\n2022-11-08: Opened up a security support case on envato.com\n2022-11-xx: Vendor publishes version 1.0.5.3 without notification which fixes this issue\n2022-11-10: Public disclosure\n9. REFERENCES\n=============\nhttps://github.com/MrTuxracer/advisories\n\nSource:packetstormsecurity.com\n\u2796 Sent by @TheFeedReaderBot \u2796\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:33.616634Z"}, {"uuid": "80082aad-d537-4b3a-8089-9aba99b3d3cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3747", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/76669", "content": "Exploit Collector\nWordPress BeTheme BeCustom 1.0.5.2 Cross Site Request Forgery\n\nhttps://2.bp.blogspot.com/-QZ2Sf2sxziM/WWlvZhEG73I/AAAAAAAAIO0/d0s8s4TXkHwnfXzbpubNEBqDxa568NQgwCLcBGAs/s1600/h60.png \nWordPress BeTheme BeCustom plugin versions 1.0.5.2 and below suffer from a cross site request forgery vulnerability.\n\nSHA-256 | 651b396c90687b1931dfce7d1f9402a1dff09a912ce895903c27111b0634e43e\n\nDownload\nRCE Security Advisory\nhttps://www.rcesecurity.com\n1. ADVISORY INFORMATION\n=======================\nProduct:        BeCustom Wordpress Plugin\nVendor URL:     https://muffingroup.com/betheme/features/be-custom/\nType:           Cross-Site Request Forgery [CWE-253]\nDate found:     2021-10-28\nDate published: 2022-11-10\nCVSSv3 Score:   5.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N)\nCVE:            CVE-2022-3747\n2. CREDITS\n==========\nThis vulnerability was discovered and researched by Julien Ahrens from\nRCE Security.\n3. VERSIONS AFFECTED\n====================\nBeTheme BeCustom 1.0.5.2 and below\n4. INTRODUCTION\n===============\nBuilt in-house add-on, perfect for agencies and web developers will let you rebrand\nBe & WordPresss Admin to your own product by replacing all the Be & Muffin logos with\nown.\n\nThis tool is supplied exclusively to the customers of Betheme and allows for changes\nlike: complete dashboard customization, replacement of logos, colors managment and much\nmore. With just a few clicks, you will turn the Be & Muffin brand into yours, thanks to\nwhich you will increase the trust of your customers.\n\nMoreover, from now on you can also customize the WPLogin page.\n\n(from the vendor's homepage)\n5. VULNERABILITY DETAILS\n========================\nThe WordPress plugin lacks an anti-CSRF protection on all of its functionalities, which\nultimately allows an attacker to (amongst others):\n\n- Set custom brandings\n- Enable/Disable BeCustom features\n- Modify the WP Login view\n- Modify the BeDashboard texts\n\nSince there is no anti-CSRF token protecting these functionalities, they are\nvulnerable to Cross-Site Request Forgery attacks allowing an attacker to perform\na variety of attacks as mentioned above.\n\nTo successfully exploit this vulnerability, a user with the right to access the\nplugin must be tricked into visiting an arbitrary website while having an authenticated\nsession in the application.\n6. PROOF OF CONCEPT\n===================\nAn exemplary exploit to reset the plugin's configuration:\n7. SOLUTION\n===========\nUpdate to BeCustom 1.0.5.3\n8. REPORT TIMELINE\n==================\n2022-10-28: Discovery of the vulnerability\n2022-10-28: CVE requested from Wordfence (CNA)\n2022-10-28: Wordfence assigns CVE-2022-3747\n2022-11-01: Vendor notification\n2022-11-07: No response. Sent another notification.\n2022-11-08: Opened up a security support case on envato.com\n2022-11-xx: Vendor publishes version 1.0.5.3 without notification which fixes this issue\n2022-11-10: Public disclosure\n9. REFERENCES\n=============\nhttps://github.com/MrTuxracer/advisories\n\nSource:packetstormsecurity.com\n\u2796 Sent by @TheFeedReaderBot \u2796\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-05T05:00:05.097257Z"}, {"uuid": "f03e8575-ecb4-4ffa-8bcb-2b5f2e1c5750", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3747", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/76669", "content": "Exploit Collector\nWordPress BeTheme BeCustom 1.0.5.2 Cross Site Request Forgery\n\nhttps://2.bp.blogspot.com/-QZ2Sf2sxziM/WWlvZhEG73I/AAAAAAAAIO0/d0s8s4TXkHwnfXzbpubNEBqDxa568NQgwCLcBGAs/s1600/h60.png \nWordPress BeTheme BeCustom plugin versions 1.0.5.2 and below suffer from a cross site request forgery vulnerability.\n\nSHA-256 | 651b396c90687b1931dfce7d1f9402a1dff09a912ce895903c27111b0634e43e\n\nDownload\nRCE Security Advisory\nhttps://www.rcesecurity.com\n1. ADVISORY INFORMATION\n=======================\nProduct:        BeCustom Wordpress Plugin\nVendor URL:     https://muffingroup.com/betheme/features/be-custom/\nType:           Cross-Site Request Forgery [CWE-253]\nDate found:     2021-10-28\nDate published: 2022-11-10\nCVSSv3 Score:   5.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N)\nCVE:            CVE-2022-3747\n2. CREDITS\n==========\nThis vulnerability was discovered and researched by Julien Ahrens from\nRCE Security.\n3. VERSIONS AFFECTED\n====================\nBeTheme BeCustom 1.0.5.2 and below\n4. INTRODUCTION\n===============\nBuilt in-house add-on, perfect for agencies and web developers will let you rebrand\nBe & WordPresss Admin to your own product by replacing all the Be & Muffin logos with\nown.\n\nThis tool is supplied exclusively to the customers of Betheme and allows for changes\nlike: complete dashboard customization, replacement of logos, colors managment and much\nmore. With just a few clicks, you will turn the Be & Muffin brand into yours, thanks to\nwhich you will increase the trust of your customers.\n\nMoreover, from now on you can also customize the WPLogin page.\n\n(from the vendor's homepage)\n5. VULNERABILITY DETAILS\n========================\nThe WordPress plugin lacks an anti-CSRF protection on all of its functionalities, which\nultimately allows an attacker to (amongst others):\n\n- Set custom brandings\n- Enable/Disable BeCustom features\n- Modify the WP Login view\n- Modify the BeDashboard texts\n\nSince there is no anti-CSRF token protecting these functionalities, they are\nvulnerable to Cross-Site Request Forgery attacks allowing an attacker to perform\na variety of attacks as mentioned above.\n\nTo successfully exploit this vulnerability, a user with the right to access the\nplugin must be tricked into visiting an arbitrary website while having an authenticated\nsession in the application.\n6. PROOF OF CONCEPT\n===================\nAn exemplary exploit to reset the plugin's configuration:\n7. SOLUTION\n===========\nUpdate to BeCustom 1.0.5.3\n8. REPORT TIMELINE\n==================\n2022-10-28: Discovery of the vulnerability\n2022-10-28: CVE requested from Wordfence (CNA)\n2022-10-28: Wordfence assigns CVE-2022-3747\n2022-11-01: Vendor notification\n2022-11-07: No response. Sent another notification.\n2022-11-08: Opened up a security support case on envato.com\n2022-11-xx: Vendor publishes version 1.0.5.3 without notification which fixes this issue\n2022-11-10: Public disclosure\n9. REFERENCES\n=============\nhttps://github.com/MrTuxracer/advisories\n\nSource:packetstormsecurity.com\n\u2796 Sent by @TheFeedReaderBot \u2796\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:58.165514Z"}]}