{"uuid": "f03e8575-ecb4-4ffa-8bcb-2b5f2e1c5750", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3747", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/76669", "content": "Exploit Collector\nWordPress BeTheme BeCustom 1.0.5.2 Cross Site Request Forgery\n\nhttps://2.bp.blogspot.com/-QZ2Sf2sxziM/WWlvZhEG73I/AAAAAAAAIO0/d0s8s4TXkHwnfXzbpubNEBqDxa568NQgwCLcBGAs/s1600/h60.png \nWordPress BeTheme BeCustom plugin versions 1.0.5.2 and below suffer from a cross site request forgery vulnerability.\n\nSHA-256 | 651b396c90687b1931dfce7d1f9402a1dff09a912ce895903c27111b0634e43e\n\nDownload\nRCE Security Advisory\nhttps://www.rcesecurity.com\n1. ADVISORY INFORMATION\n=======================\nProduct:        BeCustom Wordpress Plugin\nVendor URL:     https://muffingroup.com/betheme/features/be-custom/\nType:           Cross-Site Request Forgery [CWE-253]\nDate found:     2021-10-28\nDate published: 2022-11-10\nCVSSv3 Score:   5.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N)\nCVE:            CVE-2022-3747\n2. CREDITS\n==========\nThis vulnerability was discovered and researched by Julien Ahrens from\nRCE Security.\n3. VERSIONS AFFECTED\n====================\nBeTheme BeCustom 1.0.5.2 and below\n4. INTRODUCTION\n===============\nBuilt in-house add-on, perfect for agencies and web developers will let you rebrand\nBe & WordPresss Admin to your own product by replacing all the Be & Muffin logos with\nown.\n\nThis tool is supplied exclusively to the customers of Betheme and allows for changes\nlike: complete dashboard customization, replacement of logos, colors managment and much\nmore. With just a few clicks, you will turn the Be & Muffin brand into yours, thanks to\nwhich you will increase the trust of your customers.\n\nMoreover, from now on you can also customize the WPLogin page.\n\n(from the vendor's homepage)\n5. VULNERABILITY DETAILS\n========================\nThe WordPress plugin lacks an anti-CSRF protection on all of its functionalities, which\nultimately allows an attacker to (amongst others):\n\n- Set custom brandings\n- Enable/Disable BeCustom features\n- Modify the WP Login view\n- Modify the BeDashboard texts\n\nSince there is no anti-CSRF token protecting these functionalities, they are\nvulnerable to Cross-Site Request Forgery attacks allowing an attacker to perform\na variety of attacks as mentioned above.\n\nTo successfully exploit this vulnerability, a user with the right to access the\nplugin must be tricked into visiting an arbitrary website while having an authenticated\nsession in the application.\n6. PROOF OF CONCEPT\n===================\nAn exemplary exploit to reset the plugin's configuration:\n7. SOLUTION\n===========\nUpdate to BeCustom 1.0.5.3\n8. REPORT TIMELINE\n==================\n2022-10-28: Discovery of the vulnerability\n2022-10-28: CVE requested from Wordfence (CNA)\n2022-10-28: Wordfence assigns CVE-2022-3747\n2022-11-01: Vendor notification\n2022-11-07: No response. Sent another notification.\n2022-11-08: Opened up a security support case on envato.com\n2022-11-xx: Vendor publishes version 1.0.5.3 without notification which fixes this issue\n2022-11-10: Public disclosure\n9. REFERENCES\n=============\nhttps://github.com/MrTuxracer/advisories\n\nSource:packetstormsecurity.com\n\u2796 Sent by @TheFeedReaderBot \u2796\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:58.165514Z"}