CVE-2022-3747

🗓️ 29 Nov 2022 20:41:02Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 78 Views🌐 WEB

The Becustom plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5.2 due to missing nonce validation

Reporter	Title	Published	Views	Family All 17
0day.today	WordPress BeTheme BeCustom 1.0.5.2 Cross Site Request Forgery Vulnerability	16 Nov 202200:00	–	zdt
GithubExploit	Exploit for Cross-site Scripting in Astaro Security_Gateway_Software	30 Apr 201915:15	–	githubexploit
ATTACKERKB	CVE-2022-3747	29 Nov 202221:15	–	attackerkb
Circl	CVE-2022-3747	30 Nov 202200:29	–	circl
CNNVD	WordPress plugin BeTheme BeCustomversions 跨站请求伪造漏洞	15 Nov 202200:00	–	cnnvd
Cvelist	CVE-2022-3747 Becustom <= 1.0.5.2 - Cross-Site Request Forgery	29 Nov 202220:41	–	cvelist
EUVD	EUVD-2022-43103	3 Oct 202520:07	–	euvd
NVD	CVE-2022-3747	29 Nov 202221:15	–	nvd
OSV	CVE-2022-3747	29 Nov 202221:15	–	osv
Packet Storm	WordPress BeTheme BeCustom 1.0.5.2 Cross Site Request Forgery	15 Nov 202200:00	–	packetstorm

NVD

Vulners

Node

muffingroup becustomRange≤1.0.5.2wordpress

[
  {
    "vendor": "MuffinGroup",
    "product": "Becustom",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.0.5.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/vulnerability-advisories-continued/
github	www.github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2022-3747.txt
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/83c0e096-f054-4367-a85f-582c0771e3fe
muffingroup	www.muffingroup.com/betheme/features/be-custom/

Parameter	Position	Path	Description	CWE
betheme_label	request body	wp-admin/admin.php?page=be_custom_branding	CSRF vulnerability allowing a logged-in admin to be tricked into updating plugin settings via a forged POST request.	CWE-352
betheme_url_slug	request body	wp-admin/admin.php?page=be_custom_branding	CSRF vulnerability allowing a logged-in admin to be tricked into updating plugin settings via a forged POST request.	CWE-352
replaced_logo_url	request body	wp-admin/admin.php?page=be_custom_branding	CSRF vulnerability allowing a logged-in admin to be tricked into updating plugin settings via a forged POST request.	CWE-352
replaced_theme_image	request body	wp-admin/admin.php?page=be_custom_branding	CSRF vulnerability allowing a logged-in admin to be tricked into updating plugin settings via a forged POST request.	CWE-352
replaced_theme_desc	request body	wp-admin/admin.php?page=be_custom_branding	CSRF vulnerability allowing a logged-in admin to be tricked into updating plugin settings via a forged POST request.	CWE-352
replaced_theme_author	request body	wp-admin/admin.php?page=be_custom_branding	CSRF vulnerability allowing a logged-in admin to be tricked into updating plugin settings via a forged POST request.	CWE-352
submit	request body	wp-admin/admin.php?page=be_custom_branding	CSRF vulnerability allowing a logged-in admin to be tricked into updating plugin settings via a forged POST request.	CWE-352

08 Apr 2026 18:17Current

6Medium risk

Vulners AI Score6

CVSS 3.16.5 - 8.8

EPSS0.0098

SSVC

CWE-352