CVE-2023-39998 is a High severity (CVSS 8.2) missing authorization flaw in the Betheme theme for WordPress, up to and including version 27.1.1. Patchstack lists version 27.1.2 as the fix. Update to 27.1.2 or later, or remove the theme if you do not use it.
What's affected
Affected: the Betheme theme from n/a through 27.1.1, per the record and Patchstack. Fixed: 27.1.2, according to Patchstack.
Severity: the record's CVSS 3.1 score is 8.2 (High). Patchstack's own priority view differs in tone: Patchstack priority Low and exploitation unlikely. Both can be true, since CVSS describes impact if exploited while priority reflects how likely exploitation is. The privilege needed is Author role.
How to check if you're exposed
From a shell on the server with WP-CLI installed:
wp theme list --fields=name,version,status | grep -i betheme
In the WordPress admin, open Appearance, then Themes, and read the version in the theme details. If the version is 27.1.1 or lower, you are in the affected range. If the command finds nothing, the theme is not installed on that site. Check every site in a multisite network and every staging copy.
What to do now
- Update the Betheme theme to 27.1.2 or later from your normal update channel.
- If you do not use the theme, deactivate and delete it rather than leaving it installed.
- Review accounts with elevated or contributor level roles and remove ones you do not recognize.
- Check logs and recent changes for actions you did not make, since a missing authorization flaw may leave little trace.
- Add the plugin and theme versions to your inventory so future advisories can be matched quickly.
Why it matters
The weakness is CWE-862 (missing authorization). In practice, a user with the Author role can do things the theme does not authorize. The record does not give more detail than that, and I will not guess at specifics beyond what Patchstack publishes.
Broken access control is the most common class in WordPress plugin advisories. The code does what it was written to do, but it forgets to ask whether the caller is allowed. Fixes are usually small, which is why updating is cheap. NVD published this record on 2024-06-19, and the KEV flag is false, so there is no sign of exploitation from the sources checked.
Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan for projects that pull in packages, and the Gold directory lists this CVE alongside its CWE and related records. Reachability analysis helps you rank findings by whether the vulnerable code is actually used, which matters when a long list of advisories lands at once.
Quick check
Does this need a login?
The privilege listed is: Author role. The CVSS vector in the record matches that.
Is it being exploited?
The record's KEV flag is false and Patchstack's page does not claim exploitation. Update anyway, because the fix is a normal version bump.
Sources
Last reviewed: 19 October 2026.
