Betheme <= 26.6.2 - Missing Authorization to Theme Settings Update

The Betheme theme for WordPress is vulnerable to authorization bypass in versions up to, and including, 26.6.2. This is due to a missing capability check on the mfnvb_init_vb() function that initializes the visual editor for the plugin and discloses the plugin's page builder nonces and functionality to an attacker. This makes it possible for authenticated attacks with minimal permissions, such as a subscriber, to trigger the Betheme page editor for any post or page and view the information along with make any changes to the post/page accessed through the editor. This CVE is specific to updating the theme's settings via the editing page through the mfnvb_savethemeoptions function. This is an extension of CVE-2022-45356.