What is the CVSS score of EUVD-2026-53978?

EUVD-2026-53978 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Betheme are affected by EUVD-2026-53978?

Betheme WordPress theme through version 28.4.2 contains a critical remote code execution vulnerability exploitable by low-privileged Contributor-role users, enabling arbitrary code execution on the…

How to fix or mitigate EUVD-2026-53978?

Within 24 hours: immediately deactivate the Betheme theme and activate an alternative theme; audit and restrict all Contributor-level accounts, removing their ability to execute code or scripts. Within 7 days: deploy Web Application Firewall rules to block PHP injection patterns; enable enhanced WordPress logging for administrative and file modification events. Within 30 days: inventory all Betheme deployments across your infrastructure; monitor the vendor advisory for patch release and plan theme replacement; conduct forensic review of Contributor account activity and database modifications for signs of compromise.

Betheme EUVD-2026-53978

| CVE-2026-65548 CRITICAL

Code Injection (CWE-94)

2026-08-06 Patchstack

GHSA-4qq3-3jrp-49qg

WordPress RCE Code Injection Betheme Wordpress Theme Muffingroup

9.9

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable authenticated Contributor (PR:L) triggers code injection with no interaction; RCE escapes the app boundary (S:C) giving full C/I/A impact on the host.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:34 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

CRITICAL 9.9

DescriptionCVE.org

Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions.

AnalysisAI

Remote code execution in the Betheme WordPress theme (muffingroup) through version 28.4.2 allows a user holding a low-privileged Contributor account to inject and execute arbitrary PHP/code (CWE-94) on the underlying host. Because the CVSS vector marks scope as changed (S:C) with full confidentiality, integrity, and availability impact, a successful attack escapes the WordPress application boundary and can compromise the web server itself. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; risk is elevated by the very low privilege bar and the widespread commercial deployment of Betheme.

Technical ContextAI

Betheme is one of the most widely sold premium multipurpose WordPress themes, built on PHP and integrating heavily with the WordPress plugin/shortcode and page-builder ecosystem. The vulnerability is classified CWE-94 (Improper Control of Generation of Code, i.e. code injection), meaning attacker-influenced input is passed into a dynamic code-evaluation or template/shortcode-rendering path without adequate sanitization, allowing arbitrary code to be generated and run in the theme's PHP context. The affected component is identified by the CPE cpe:2.3:a:muffingroup:betheme:*:*:*:*:*:*:*:* covering all builds up to and including 28.4.2. The specific vulnerable feature is not disclosed in the available Patchstack summary, but the Contributor-level entry point strongly implies an authenticated content-authoring surface (such as shortcode, builder element, or metadata processing) reachable by users who can create but not publish posts.

RemediationAI

Update Betheme to the vendor's patched release above 28.4.2 as soon as it is confirmed; the provided intelligence does not include an exact fix version, so verify the corrected build directly on the Patchstack advisory (https://patchstack.com/database/wordpress/theme/betheme/vulnerability/wordpress-betheme-theme-28-4-2-remote-code-execution-rce-vulnerability) and the muffingroup/ThemeforForest changelog before deploying. Until a patched version is confirmed and installed, reduce exposure by tightening role assignments: revoke or downgrade untrusted Contributor accounts, disable open user registration or force manual approval, and restrict the default Contributor role from reaching theme shortcode/builder functionality (trade-off: this limits legitimate multi-author workflows). Deploy a WordPress WAF (such as Patchstack's virtual patch or an equivalent ruleset) to filter code-injection payloads against theme endpoints, and audit existing posts, uploads, and PHP files for signs of injected code as a detection measure. Absence of a stated fix version means 'No vendor-released patch identified at time of analysis' from this data - confirm with the vendor rather than assuming none exists.