The Betheme WordPress theme suffers from a PHP Object Injection vulnerability due to unsafe deserialization of the 'mfn-page-items' post meta value. This allows authenticated users with contributor or higher privileges to inject malicious PHP objects. The vulnerability exists in all versions up to and including 27.5.6. Although Betheme does not provide a direct POP chain, the presence of additional vulnerable plugins or themes could enable an attacker to perform destructive or unauthorized actions such as deleting files, accessing sensitive information, or executing arbitrary code. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability with network attack vector and low attack complexity.

Successful exploitation requires authenticated access with contributor-level privileges or higher. Without an existing POP chain in Betheme, direct exploitation is limited; however, if combined with other vulnerable components, attackers could delete arbitrary files, retrieve sensitive data, or execute code. The vulnerability affects the confidentiality, integrity, and availability of the affected WordPress site.

Patch status is not yet confirmed — no official patch or remediation link is provided. Users should monitor the vendor MuffinGroup for updates or official advisories. Until a fix is available, restrict contributor-level access and above to trusted users only. Review installed plugins and themes for additional vulnerabilities that could enable exploitation via a POP chain. Consider disabling or restricting the use of the 'mfn-page-items' post meta if possible.