CVE-2026-65548 in the Betheme WordPress theme grants Remote Code Execution at the Contributor privilege level — a CVSS 9.9 that reflects not just technical severity but a structural failure in how the theme handles role boundaries. Contributors should be able to draft content and nothing else. The fact that RCE is reachable at this tier means Betheme exposed privileged functions (most likely AJAX handlers or template processors) to a role that should never reach them.
What makes this worse than a typical privilege-escalation bug is the blast radius. Contributor accounts are the most common low-privilege tier in WordPress deployments — granted to freelance writers, agency staff, contractors, and anyone needing draft access. Organizations implicitly treat this tier as negligible risk, which makes it exactly the kind of account an attacker targets for lateral movement. Compromising a Contributor at a news site or agency gives you code execution on the server, and from there, pivots to the rest of the infrastructure.
The EPSS score of 0.00439 is not a reason for complacency. Low EPSS typically means the vulnerability hasn't been widely weaponized yet — not that it's hard to exploit. For a vulnerability this severe at this privilege level, the likely explanation is that attackers haven't needed to look. Contributor accounts are common enough that opportunistic scanning will find them.
The deeper problem is that this is not an isolated incident. This exact vulnerability class — Contributor-to-RCE via unpatched AJAX handlers — has appeared in premium themes repeatedly over the past decade. The fix pattern is always the same: add a capability check to the AJAX endpoint, typically current_user_can('manage_options') or at minimum current_user_can('edit_posts'). But the ecosystem has no mechanism to prevent the next theme from making the same mistake. Market pressure to be "the most customizable theme" directly incentives exposing privileged hooks, and WordPress's AJAX architecture has no built-in privilege boundary enforcement — developers must manually add checks, and under deadline pressure, they don't.
If you're running Betheme, treat this as a critical priority: inventory all AJAX endpoints registered by the theme, verify that every one enforces a capability check appropriate to its function, and audit for orphaned or deprecated features that may have left backend code running after the UI was removed. Contributor accounts on your WordPress site are now part of your attack surface — act accordingly.